A 472-character invisible payload steered an email summarizer into reporting only the attacker's text

Nearly half the input never reached the reader's eye. Of 1,009 characters passed to the model, 537 were displayed and 472 were hidden injection text ^[5], which works out to 46.8 percent of the model's input invisible to the person reading the output ^[6]. The concealment was ordinary CSS: font size 0 pixels, white text, zero line height, invisible to humans and machine-readable ^[3].

Nothing in the pipeline preferred the visible half. The hidden instructions told the summarizer to ignore the message's legitimate text, treat the hidden text as the thing to summarize, and mention neither the instructions nor the legitimate text ^[4]. It complied on all three counts: none of the summaries referenced the notice to the summarizer, the superseded draft, or the authoritative record ^[9]. Waseem Ahmed, head of engineering at Secure.com, put the output condition plainly: the summary reads clean while the numbers and dates are fabricated, and the reader gets no warning ^[13].

Forcepoint researcher Ben Gibney says the rigorous measurement proves the attack succeeds reliably in production conditions ^[11]. The test was one isolated email summarizer running an unguarded LLM pipeline ^[2]. That is a narrower result than the phrasing carries. Reliability against a pipeline with no filtering is a floor, not a measurement of the products that do filter, and the source material does not report a single test against one that does. Steve Wilson, who founded and co-chairs the OWASP GenAI Security Project, calls the work a good educational demonstration, simple and reproducible ^[15], and notes indirect prompt injection has been a known problem almost from the beginning of modern LLM application security, back to the original OWASP Top 10 for LLM Applications list in 2023 ^[16].

The part worth pricing is delivery. Scott Miserendino, CTO at DataBee, points out that the adversary never has to solve the problem of reaching the model: direct LLM access is usually restricted behind network controls and paid accounts, while a mail system forwards attacker-supplied content to the model automatically ^[14]. Every control that gates who may query the model is bypassed by anyone who can send mail to a mailbox that summarizes it.

Severity is a function of permissions from here. Gibney's own escalation case is a summarizer allowed to send email or approve requests, which he rates a much higher-severity target ^[12]. The concealment here is three CSS properties ^[3], and this work stays firmly in the lab: unnamed product, unnamed vendor, no threat actor identified, and no in-the-wild case ^[18]. What separates this lab result from an incident is whether the summarizer downstream can act.