Hidden HTML Prompts Manipulate AI Email Summarizers

A new security analysis published by Dark Reading reveals that attackers can exploit AI-powered email summarization features by injecting hidden HTML code into emails. The hidden prompts, rendered invisible to human users, are parsed by the AI model when generating summaries. This allows the model to output attacker-controlled text that can distort the perceived content of the email.

The technique leverages standard HTML hiding methods, such as cascading style sheets (CSS) properties that set text to white-on-white or position elements off-screen. When the AI summarizer processes the email, it reads the full HTML source, including the hidden elements. The model then incorporates the injected prompt text into its summary output, potentially praising malicious content or omitting critical warnings.

The report notes that multiple email platforms and productivity tools integrating AI summarization are potentially affected. Because the manipulation occurs at the model input level, the resulting summaries appear legitimate to the user, increasing the risk of successful social engineering. The researchers demonstrated the issue in a controlled setting, showing how a benign-looking email could be summarized as safe despite containing hidden malicious instructions.

While no widespread in-the-wild attacks have been confirmed to date, the researchers warn that the technique could be adapted for phishing, business email compromise, or disinformation campaigns. The findings underscore the need for AI developers to sanitize HTML inputs and for users to maintain skepticism toward AI-generated summaries, especially for sensitive communications.