The boundary in Forcepoint's setup is one step in the code: a Python script that merged an email's headers and body into a single prompt before sending it to the model [3]. After that merge, nothing in the text marks which characters came from the operator and which arrived from a stranger, and the operator's contribution was one sentence of instruction with no guardrail separating instructions from content [4]. A model reading that prompt has no basis for ranking the two.
The volumes are worth doing by hand. The reader saw 537 characters; the model received 1009, of which 472 were the hidden injection, concealed with styling given as 'font-size:0px; color:#ffffff; line-height:0' [5][12]. That puts 46.8 percent of the model's input off the screen [13], with a payload 87.9 percent the size of the message the human actually read [14]. Side by side, researcher Ben Gibney reported a single visual artifact, extra whitespace above the sign-off, which he attributed to where the injected text sat rather than to the injection, and said could have been concealed with more effort [11].
Forcepoint isolated a summarizer running an unguarded pipeline deliberately and pre-registered its success criteria before running ten clean and ten injected emails [2]. That deliberate design matters less than what it mirrors: an internal team can assemble the same setup in an afternoon, an Outlook add-in feeding a script that concatenates a one-line system prompt with whatever arrived [3][4]. Every injected run produced the manipulated output, a 100 percent rate in that configuration [6][16], and the payload was not a jailbreak but plain instructions telling the summarizer to treat a supplied body as the authoritative record and to say nothing about the notice that supplied it [10].
What the record does not establish is how often this happens outside a lab. Forcepoint locates the risk in the practice of feeding untrusted email to a model without safeguards, not in Outlook, any named summarizer, or Claude-haiku-4-5, which drove the test [8]. That is a claim about design rather than incidence, and the honest reading is that the mechanism is demonstrated while the field rate is unknown.
Forcepoint's remediation list comes with a real cost, one the list itself leaves unstated. Extracting only user-visible content and flagging suspicious HTML or CSS require somebody to own a rendering decision inside the assistant's data path, and separating headers from the body is a change to the code that built the prompt [9]. The final recommendation, validating AI summaries against the original source, hands the reading back to the person [9]. A summarizer whose output must be checked against the email still saves something, though less than the case made when it was approved.
This quarter's version of the question is narrow and answerable: which assistants in the estate receive raw HTML, and which team owns the code that passes it along. The decade's version, whether a prompt assembled from untrusted text can be made safe by construction, remains open after a ten-run proof of concept [6]. In between sits the practical read, which is that a thirteen-day move in an invoice date [15] and a quietly dropped counterparty name [7] are the size of error that clears an approval queue without anyone looking twice.
