Hidden HTML Prompt Injection Hijacked an Email Summarizer in 10 of 10 Tests
Summary
In a controlled lab, hidden HTML instructions altered an unguarded email summarizer’s output in all 10 injected runs, changing invoice and date details without signaling tampering. The test used one message, one model and no guardrails.
Key points
- Researchers tested an Outlook add-in that sent email headers and body text to an LLM summarizer through an unguarded pipeline.
- The injection was concealed using HTML styling that made text invisible in Outlook while leaving it in the content sent to the model.
- Across 10 injected runs, summaries gave a false invoice amount and date in every run, while omitting information included in the benign summaries.
- The summaries did not flag the hidden instructions, conflicting information or fabricated details; latency differences were not considered noticeable to users.
- The experiment used synthetic data, one message and one model at temperature 0; it did not test the hidden text and injection instruction separately or systems with guardrails.
- Suggested defenses include extracting only user-visible text, detecting hidden styling, treating input and model output as untrusted, cross-checking summaries against source emails and limiting model permissions.
Article Details
- Attack Vectors
- In a laboratory proof of concept, hidden text in an email body used HTML styling (font-size:0px; color:#ffffff; line-height:0) to conceal prompt-injection instructions from the Outlook reader while leaving them in the content sent to the summarizer.
- The tested pipeline combined email headers and body into a single prompt and sent it to an LLM without guardrails; the injected instructions altered the generated summary in all 10 injected-email runs.
- Defensive Notes
- Extract only text actually presented to the user before sending content to an LLM, and detect hidden styling in the pipeline.
- Separate email headers from body text in the system prompt and mark retrieved content as untrusted.
- Treat model output as untrusted and cross-check it against the source email.
- Apply least privilege to actions available to a summarizer, and do not rely on mail hygiene alone to reveal hidden content.
People
Products
Claude Haiku 4.5The model used to drive the summarizer in this investigation was claude-haiku-4-5 and we would expect similar results from other models in an unguarded pipeline like this.OutlookFor this investigation we set up an Outlook add-in which sends the email body and headers to a service that summarizes email content using an LLM API endpoint.