Indirect Prompt Injection Hijacks AI Email Summarizers

• •Indirect prompt injection can alter AI email summaries without hidden text.
• •Researchers demonstrated consistent manipulation across 60 trials with forged email content.
• •The study highlights vulnerabilities in AI summarizers, emphasizing the need for better safeguards.

Forcepoint X-Labs has revealed that indirect prompt injection can manipulate AI email summarizers without hidden text. Researchers tested six emails with forged content that altered summary outputs, consistently producing false information across multiple trials. The study demonstrated that the structure of email threads can carry instructions to the AI, leading to significant discrepancies in summarized data. For instance, an original invoice of €8,650 was changed to €46,200 in the summaries. The tests utilized an unguarded Outlook-based pipeline powered by Claude Haiku 4.5. The findings highlight the vulnerabilities in AI summarizers and the potential for misinformation without explicit instructions. This research builds on previous work that used hidden HTML content for similar manipulations. The results do not confirm exploitation in real-world scenarios but raise awareness of the risks associated with AI summarization tools.