genai
SECURITY LAB
IncidentsIndirect injection

Gemini's Email Summary Turned into a Phishing Lure

Medium severityJuly 2025LLM01: Prompt InjectionLLM10: Improper Output Handling
Status: Disclosed via Mozilla's 0DIN (Jul 2025); Google says it is hardening defences and saw no evidence of abuse
On this page

When the AI summary is trusted more than the email itself, poisoning the summary is the attack.

WhenJuly 2025
TargetGoogle Gemini for Workspace (Gmail summaries)
VendorGoogle
ResearcherMarco Figueroa (Mozilla 0DIN)
TechniqueIndirect injection via invisible HTML in the email body
Disclosed0DIN, Jul 10, 2025 (no CVE)
Attack flow
  1. 1Attacker sends an email with instructions hidden in invisible HTML/CSS text
  2. 2The recipient clicks “Summarise this email”
  3. 3Gemini obeys the hidden text and appends a fake “security alert” to its summary

What happened

In July 2025, via Mozilla's 0DIN bug-bounty programme, researcher Marco Figueroa showed that an email with instructions hidden in invisible HTML/CSS could hijack Gemini's “summarise this email” feature. The summary appended an attacker-controlled message — a fake “your Gmail password was compromised” alert with a scam phone number — inside Gemini's trusted panel. No links or attachments were required.

How the attack worked

The hidden text (zero font size, white-on-white, wrapped in tags) is invisible to the reader but part of what Gemini summarises. Gemini follows it and emits the attacker's text as though it were part of the summary — so a scam appears in a surface users trust.

Root cause

Untrusted email content is treated as instructions, and the resulting output renders in a trusted surface with no separation between the two.

What a test would have caught

Feeding the summariser emails that carry hidden-HTML injection and checking whether the summary reflects attacker instructions is a direct test — and exactly how this was found.

How to prevent it

  • Strip or normalise invisible HTML/CSS before the model sees the email.
  • Treat the email body as untrusted data, not instructions.
  • Don't let summaries render attacker-authored calls to action, and label AI output clearly.

Feel it yourselfThe replay lab lets you inject instructions through email content and watch them shape the assistant's output.

FAQ

Why is a poisoned summary dangerous?

People trust the AI summary panel more than a random email. A fake “your password was compromised, call this number” shown there reads like a genuine Google alert — turning a summary feature into a phishing channel.

How were the instructions hidden?

In the email body using HTML/CSS tricks — zero font size and white-on-white text wrapped in tags — invisible to the reader but ingested by Gemini when it summarised the message.

Was any data stolen?

No data exfiltration in this case; the harm is social-engineering. It's an output-handling failure — untrusted content shaping trusted-looking output.

Replay this attack
Inject instructions through email content and watch them shape the assistant's output — the Gemini-summary pattern.
Open the live lab
Runs as a live, sandboxed lab. Sign-in required — this replay is a Pro lab. Recreates the attack class, not this exact branded bot.