Security researchers inserted instructions into an email using zero-size white text: invisible on screen, perfectly present in the content passed to the model. The displayed message was 537 characters long; the one received by the AI was 1,009. All ten attempts produced a manipulated summary, notably shifting an invoice deadline by several days and removing a name.
We have been describing agentjacking for months. Here is the simplest and most worrying demonstration we have seen, because it requires no particular skill.
The mechanism, disconcertingly simple
A rich-format email contains formatting code. You can place text in it with a zero font size, or in white on a white background. Your email client does not display it, or displays it imperceptibly.
But when an AI assistant summarises this message, it does not see the formatting: it receives the textual content. The hidden instructions therefore arrive intact, mixed with the legitimate message, with nothing to distinguish them.
And as we have explained several times: a model does not natively distinguish between the data it must process and the instructions it must follow. Everything is text. A sentence found in an email saying to change a date looks exactly like a user directive.
Why this case is more serious than it seems
Three reasons.
No skill required. Where the Copilot flaw fixed last week exploited an undocumented parameter, this one uses only standard formatting. Anyone who knows how to write a rich-format email can reproduce it.
The success rate is total. Ten attempts, ten manipulated summaries. This is not an attack that works sometimes, but a systematic behaviour.
The manipulation is plausible. Moving an invoice deadline by two weeks and removing a name triggers no alert. It is the kind of change you only notice when it is too late, and it has very concrete consequences.
The danger does not come from the sophistication of the attack; it comes from usage. You ask for a summary precisely to not read the original message. The victim therefore has no way to spot the discrepancy, since they have delegated the reading. It is the same mechanism we described regarding modernised scientific code: the most dangerous errors are those that occur where you have stopped checking.
The countermeasures
The researchers recommend a simple and effective measure: that summarisation tools extract only the content actually visible to the user, and treat the email as untrusted data.
This principle deserves to be generalised, because it applies well beyond email. Any content coming from outside — a web page, a received document, a message — should be treated as data to analyse, never as instructions to follow.
The difficulty is that this separation does not exist naturally in the architecture of these models. It must be imposed by the software surrounding them, and many integrations neglect it.
For a user, two reflexes. Check the original message when the summary concerns something that commits you — a deadline, an amount, an address. And be wary of a summary that asks you to act: that is exactly what an injection seeks to produce.
What to remember
This demonstration fits into a series we have been documenting for weeks, and the pattern repeats: every feature that makes an assistant useful widens its attack surface.
Reading your emails makes it valuable and exposes it to what your emails contain. There is no version of this tool that is both powerful and without a surface, as we already concluded regarding the Copilot flaw.
What distinguishes this case is its technical banality. We will not have to wait for a sophisticated attacker: a formatting trick known for twenty years is enough. That is probably the most useful signal for anyone deploying these tools in a company.