Text invisible to the human eye in Outlook, but perfectly readable to an AI, was enough to make an email summarizer change an invoice amount from €8,750 to €46,200 — with no warning to the recipient. That's what Forcepoint X-Labs demonstrated on August 25, in another case of what the security industry now calls "indirect prompt injection": malicious instructions hidden inside the content an AI processes, not typed by the person using the system.
What Changed
Forcepoint's researchers hid an instruction payload inside an email's HTML, using a font size and color that made it invisible on screen in Outlook — but that reached the language model behind the summarizer intact. Across ten runs with the malicious email, the attack succeeded all ten times, altering information in the summary delivered to the user with no visible sign of manipulation. The model used in the test was Anthropic's Claude Haiku 4.5, running in what the researchers themselves describe as an "unguarded" pipeline — meaning without the instruction-versus-data separation defenses now considered best practice. Context matters here: this kind of flaw isn't exclusive to one vendor. Research from Immersive Labs and the Cloud Security Alliance has already demonstrated variations of the same attack against Microsoft Copilot and Google Gemini when they process email. The problem is architectural — how a system separates (or fails to separate) instructions from external content — not an isolated flaw in one specific model.
Why It Matters
AI email summarizers exist precisely to save the time of someone who won't read the full email — which also means no one will check the original against the summary. If the summary itself can be silently manipulated, the tool's core value proposition (skipping manual verification) becomes exactly the blind spot that lets fraud through. Microsoft, in its own guidance on the topic, recommends defense in depth: clearly separating instructions from external data (for example, wrapping external content in markup the model is trained to treat strictly as data), monitoring AI interactions for suspicious patterns, and, where possible, reducing an agent's autonomy for tasks that don't need to interpret arbitrary content.
The Impact for Brazil
Brazilian companies that have already adopted, or are evaluating, email, contract, or customer-service copilots should treat this kind of finding as a procurement criterion, not a technical footnote: it's worth explicitly asking vendors what defenses against indirect prompt injection exist in the product, rather than accepting generic security or LGPD-compliance assurances, which don't cover this kind of attack. Operationally, any AI summary that feeds into a financial, contractual, or billing decision deserves a human verification step until the vendor demonstrates — not just promises — protection against this attack vector.
Entercast's Take
This finding complements, rather than repeats, what we covered here on Google Cloud's agent identity: knowing who an agent is and what it can access is one thing; being able to trust what it tells you after accessing that content is a different matter entirely. AI agent governance needs to cover both fronts — and the pace of adoption in Brazil shouldn't outrun the habit of verification. Before letting an AI-generated summary decide something involving money or a contract, it's worth keeping — at least for now — a human checking the original source.