You can’t see it. Your AI assistant can’t stop reading it. That’s the whole attack.

Forcepoint X-Labs published a proof-of-concept on August 25 showing that a few lines of HTML — invisible to anyone reading the email normally — can silently rewrite what an AI summarizer tells you about that email. No malware. No suspicious link. No visible sign of tampering, in the email or in the summary. Just text a human never sees and a model that reads everything.

The timing is the part worth sitting with. This lands exactly as Outlook Copilot, Gemini in Gmail, and a growing list of Claude-connected email tools are being pitched to professionals as the fix for inbox overload. Forcepoint didn’t publish a theoretical warning about prompt injection. It published a working demonstration of the exact failure mode those tools are structurally exposed to.

Quick Summary: What Happened

Detail	Info
Published	Aug 25, 2026, by Forcepoint X-Labs; covered by Dark Reading (Aug 25) and CSO Online (Aug 27)
Technique	HTML styled font-size:0px; color:#ffffff; line-height:0 — invisible on screen, fully readable to an LLM
What’s exposed	The architecture behind any AI email summarizer, including Outlook Copilot, Gemini in Gmail, and Claude-connected inboxes
Result	10 of 10 injected test runs produced a hijacked summary; 0 of 10 benign runs did
Payload size	Visible email: 537 characters. Sent to the model: 1,009 characters. Hidden: 472
Prior research	Builds on Forcepoint’s April 2026 finding of 10 verified indirect-prompt-injection payloads already live on the open web

Bottom line: The gap between what you see in an email and what your AI assistant actually reads is now a documented, repeatable attack surface — and it doesn’t require you to click anything.

What Actually Happened

Forcepoint X-Labs built an isolated lab: a throwaway Microsoft tenant, synthetic invoice data, and an Outlook add-in that piped email headers and body text to an LLM-powered summarization service. That’s the same basic pipeline every AI email summarizer runs, whether it’s Microsoft’s, Google’s, or something built on Claude.

The researchers took an ordinary-looking invoice email and buried a second message inside it, styled with CSS that zeroes out font size, sets the text color to white, and collapses line height to nothing. Open the email and you see a normal invoice. Feed it to a model and the model sees the invoice plus a full second set of instructions the human sender never intended to be read as instructions — because, to a human, they were never there at all.

The numbers are specific enough to make the point without needing a demo: the visible email ran 537 characters. What the model actually received was 1,009 characters — 472 of them hidden. Across ten runs of the injected version, the summarizer produced a hijacked result every single time. The invoice deadline moved from August 21 to September 3 at 2 p.m. A name in the original message, Diego Siciliani, quietly disappeared from the output. Ten benign control runs produced zero errors. That’s not a flaky model having a bad day. That’s a payload working exactly as designed, 100% of the time.

One detail matters more than it might seem: Forcepoint ran this against a summarizer powered by Claude Haiku 4.5, not just a generic stand-in. Same result. Forcepoint’s own conclusion is blunt about what that means — this isn’t a bug in one company’s product. It’s a structural risk in how untrusted email gets fed to any LLM without a boundary between “content to summarize” and “instructions to follow.”

How Does an Invisible-Text Prompt Injection Attack Work?

The mechanics are simple enough to explain in five steps, which is exactly what makes this attack class hard to fully close off:

1. The attacker crafts an email that looks completely normal — an invoice, a meeting note, a shipping confirmation.
2. A hidden block of HTML is appended, styled so it renders as nothing: zero font size, white-on-white color, zero line height, or any combination that defeats human vision without breaking HTML parsing.
3. The email reaches an AI summarizer — Outlook Copilot, Gmail’s Gemini integration, a Claude-based email plugin, or any tool that extracts the full HTML body to feed a model.
4. The model parses the entire document, including the invisible section, because rendering CSS is a browser’s job, not an LLM’s. To the model, hidden text and visible text are just text.
5. The AI outputs a summary shaped by the hidden instructions — a changed deadline, a fabricated action item, a stripped-out name — with nothing in the visible email or the summary UI signaling that anything was altered.

That last step is the actual danger. A phishing link can be hovered over and inspected. A hijacked AI summary looks exactly like every other AI summary.

Why This Matters

The pitch for AI email assistants has been consistent all year: let the model triage your inbox so you don’t have to read everything yourself. Best AI Email Assistants is one of our most-read guides for exactly that reason — people want the summary to be trustworthy enough to act on without opening the original.

This research is the uncomfortable answer to that trust question. If a hidden 472-character payload can flip an invoice deadline and delete a name with 100% reliability in a lab setting, the same technique works against production tools running the same architecture. Forcepoint isn’t claiming Outlook Copilot itself was breached — its test ran on a custom add-in, not Microsoft’s shipping product — but the pipeline it modeled (extract HTML, feed it whole to an LLM, trust the output) is not meaningfully different from what powers commercial summarizers today.

For professionals who’ve started routing financial documents, contracts, or client correspondence through an AI summary instead of reading the source, that’s the risk that just went from theoretical to demonstrated. An attacker doesn’t need you to click a link. They need you to trust a summary.

What Are Your Options Now

If you use an AI email summarizer for anything with a dollar figure, deadline, or legal term attached to it, read the underlying email before acting on the AI’s version — at least until your vendor confirms it sanitizes hidden HTML/CSS before summarization. Treat the summary as a pointer to the source, not a replacement for it.

If you’re an IT or security lead evaluating Copilot, Gemini, or Claude-based email tools for your org, ask the vendor directly whether their pipeline strips zero-size and same-color-as-background text before it reaches the model, and whether headers are separated from body content. Our AI safety guide for business leaders covers the broader vendor-questions checklist this kind of disclosure belongs on.

If you’re building or automating email workflows yourself, Forcepoint’s own recommendations are the right starting checklist: extract only what’s visibly rendered, flag suspicious inline styling before it hits the model, keep headers and body separated, and treat all inbound email as untrusted input — not clean context. Anyone automating email with AI right now should be building that assumption in from the start, not bolting it on after an incident.

The Bigger Picture

This isn’t Forcepoint’s first warning shot. Back in April, X-Labs published research identifying 10 verified indirect-prompt-injection payloads already live on the open web — not lab demos, actual working attacks, covering financial fraud, data-destruction commands, and API-key exfiltration attempts, all using the same family of concealment tricks: invisible CSS, HTML comments, and metadata abuse. The email summarizer research is that same threat model moved from web pages into the inbox, which is arguably the higher-stakes surface, since inboxes already contain financial and personal data by default.

The uncomfortable pattern across both reports: indirect prompt injection isn’t a hypothetical risk analysts keep gesturing at. It’s a technique with a documented history of live deployment, and every new AI surface — browsers, agents, and now email — inherits the same weakness the moment it starts treating retrieved content as trustworthy context instead of untrusted input.

Our Take

We think the most important sentence in Forcepoint’s writeup is the one that lets Microsoft, Google, and Anthropic all off the hook individually and puts the industry on the hook collectively: this isn’t a flaw in one summarizer, it’s a flaw in an architecture nearly every AI email tool currently ships. That’s a less satisfying headline than “Copilot has a bug,” but it’s the more accurate — and more concerning — story.

The 100%-success-rate detail is what should worry vendors more than the invisible-text trick itself. Ten out of ten isn’t a lucky exploit chain. It’s a reliable technique with no failure mode observed in testing, against a model as capable as Claude Haiku 4.5. Until summarizers start sanitizing HTML before it reaches the model — stripping zero-size text, flagging same-color-as-background styling, separating instructions from content — every “AI read your inbox so you don’t have to” pitch comes with an asterisk nobody’s putting in the marketing copy.

Frequently Asked Questions

Q: Is Outlook Copilot actually confirmed to be vulnerable to this attack? A: Forcepoint’s proof-of-concept used a custom-built Outlook add-in and lab environment, not Microsoft’s production Copilot. Forcepoint explicitly said the risk isn’t specific to any one vendor or LLM — it’s a general weakness in how AI summarizers process raw HTML email. The architecture the research modeled matches what Copilot and comparable tools run.

Q: What exact HTML trick did the researchers use? A: CSS styling of font-size:0px; color:#ffffff; line-height:0, which renders text invisible to a human reader in a normal email client while leaving it fully intact in the HTML an AI model parses.

Q: Does this affect Gmail’s Gemini integration and Claude email tools too? A: The underlying vulnerability — feeding full HTML to an LLM without stripping hidden content — applies to any AI summarizer built the same way, which includes Gemini’s inbox features in Gmail and Claude-connected email plugins, not just Microsoft’s tools.

Q: How much hidden text did it take to hijack the summary? A: 472 characters of injected instructions, added to a 537-character visible email, for a total of 1,009 characters sent to the model. The hijack succeeded in all 10 test runs.

Q: What did the hijacked summary actually get wrong? A: The AI-generated summary moved an invoice deadline from August 21 to September 3 at 2 p.m. and dropped a name, Diego Siciliani, that appeared in the original email — changes invisible to anyone comparing the summary against what they could see of the source email.

Q: Is this connected to other prompt injection research from Forcepoint? A: Yes. It builds on an April 2026 Forcepoint report that found 10 verified indirect-prompt-injection payloads already active on the open web, covering financial fraud, data-destruction commands, and API-key theft attempts.

Q: What can I do right now to protect myself? A: Don’t treat an AI-generated email summary as a substitute for reading the source when money, deadlines, or legal terms are involved. If you manage email tools for an organization, ask vendors whether their pipeline strips hidden HTML/CSS before summarization.

Q: Does this mean I should stop using AI email assistants? A: Not necessarily — but it does mean treating summaries as a convenience layer rather than a source of truth for anything consequential, until vendors confirm they’ve closed this specific gap.

---

Last updated: August 29, 2026. Sources: Forcepoint X-Labs — An Invisible HTML Payload Silently Hijacked Every Email Summarizer Run · Forcepoint X-Labs — Indirect Prompt Injection in the Wild · Dark Reading — Hidden Prompts Trick AI Into False Email Summaries · CSO Online — AI can be made to read an email much differently than you do.

Related reading: Best AI Email Assistants in 2026 · Microsoft Copilot Cowork Review 2026 · Gmail Gemini 3 AI Inbox Review 2026 · How to Automate Email with AI in 2026 · AI Safety for Business: What Leaders Need to Know