Same Worm, New Attack Vector

Forcepoint hid a malicious prompt in an email’s HTML code. That caused an AI summarizer to report data incorrectly, including the invoice total that appeared in the original message.

by Tim Leogrande, BSIT, MSCP, Ed.S.

🗓 SEP 3 2026 • 3 MIN 30 SEC READ

📰 NEWS

In a post four weeks ago, I discussed a vulnerability that allows hackers to hide instructions in a Microsoft Word document using white 8-point text, which is invisible to anyone reading the file in Word, but can be read by an AI platform. When Copilot was used to summarize that document, the bot followed the hidden instructions, cutting the original numbers in the report in half, and then copied the malicious code into the summary.

New testing by Forcepoint X-Labs shows the same attack works on email. It’s a different app, running a different model from a different AI vendor, but the underlying problem is the same. AI platforms can’t reliably distinguish between the text they’re reading and the instructions they’re being given.

<aside> 💡

The research is the latest example of how attackers can use indirect prompt injection to manipulate an AI system to do something unintended while processing an external source.

</aside>

Numerous researchers have demonstrated the vulnerability stemming from AI’s inability to reliably differentiate between the data it is analyzing and the instructions it needs to execute. Prompt injection has ranked as the number one risk in the OWASP Top 10 for LLM and generative AI apps since 2023.

The Forcepoint X-Labs team set up the lab environment with synthetic data and a proof-of-concept Outlook add-in which passes along email headers and body text to a large language model (LLM)-based summarization service. This service uses Claude Haiku 4.5 to generate the summaries. The researchers built a simple email-to-LLM pipeline with no safeguards to prevent the AI from confusing instructions with content. They then wrote an email that looked perfectly normal on the surface, but had a malicious prompt hidden inside the HTML code. The X-Labs team ensured the harmful prompt wasn’t rendered to the user when the email was viewed in Outlook, but was still present in the HTML passed to the email summarizer, by setting the text color and font size to be invisible.

Next, the researchers sent ten benign and ten injected versions of their test email to the summarizer. In every one of the ten injected runs, the AI generated summaries contained altered information instead of summarizing the email as intended. For example, in one case, the altered summary said there was an outstanding payment of €46,200, while the original email showed the amount of an outstanding invoice as €8,750. The injected summaries also reported a payment date of September 3, 2026 in place of the real August 21 deadline, and dropped the name of the contact the original email identified. In none of these cases would an actual email recipient know about the changes.

The experiment is simple. One model, one message, one batch of ten runs each for the benign and injected emails. It’s far from a full-blown attack scenario involving thousands of identical messages targeted to multiple victims. But the key takeaway is that there was no mention of the hidden instructions, or any indication the email had been corrupted.

The security impact is limited to the task being performed by the summarizer. In this study, the summarizer obeyed the malicious instructions and presented the data that it was told to display. The security implications of an agentic summarizer with email and calendar scheduling capabilities would be much greater.

<aside> 💡

The new research reconfirms risks of AI that have long been known. Hidden text in email has been around for decades, and prompt injection has been studied extensively over the past few years. What’s new is the success rate. The researchers planted known values in both the injected and benign emails ahead of time, then checked which values came back. The prompt injection succeeded in all ten runs.

</aside>

From a defensive perspective, Forcepoint recommends businesses treat incoming content and AI-generated output as potentially untrusted. In addition to having detection mechanisms in place to catch attempts to hide text using HTML or other formatting, companies should ensure that models only receive content that is actually meant for users, separate email metadata and message content when constructing prompts, and validate AI-generated summaries against the source.

Security teams should also implement least privilege for any actions an AI assistant takes, to minimize damage in the event of a successful attack.