Gemini's Email Summary Turned into a Phishing Lure
On this page
When the AI summary is trusted more than the email itself, poisoning the summary is the attack.
| When | July 2025 |
|---|---|
| Target | Google Gemini for Workspace (Gmail summaries) |
| Vendor | |
| Researcher | Marco Figueroa (Mozilla 0DIN) |
| Technique | Indirect injection via invisible HTML in the email body |
| Disclosed | 0DIN, Jul 10, 2025 (no CVE) |
- 1Attacker sends an email with instructions hidden in invisible HTML/CSS text
- 2The recipient clicks “Summarise this email”
- 3Gemini obeys the hidden text and appends a fake “security alert” to its summary
What happened
In July 2025, via Mozilla's 0DIN bug-bounty programme, researcher Marco Figueroa showed that an email with instructions hidden in invisible HTML/CSS could hijack Gemini's “summarise this email” feature. The summary appended an attacker-controlled message — a fake “your Gmail password was compromised” alert with a scam phone number — inside Gemini's trusted panel. No links or attachments were required.
How the attack worked
The hidden text (zero font size, white-on-white, wrapped in tags) is invisible to the reader but part of what Gemini summarises. Gemini follows it and emits the attacker's text as though it were part of the summary — so a scam appears in a surface users trust.
Root cause
Untrusted email content is treated as instructions, and the resulting output renders in a trusted surface with no separation between the two.
What a test would have caught
Feeding the summariser emails that carry hidden-HTML injection and checking whether the summary reflects attacker instructions is a direct test — and exactly how this was found.
How to prevent it
- Strip or normalise invisible HTML/CSS before the model sees the email.
- Treat the email body as untrusted data, not instructions.
- Don't let summaries render attacker-authored calls to action, and label AI output clearly.
Feel it yourselfThe replay lab lets you inject instructions through email content and watch them shape the assistant's output.
FAQ
Why is a poisoned summary dangerous?
People trust the AI summary panel more than a random email. A fake “your password was compromised, call this number” shown there reads like a genuine Google alert — turning a summary feature into a phishing channel.
How were the instructions hidden?
In the email body using HTML/CSS tricks — zero font size and white-on-white text wrapped in tags — invisible to the reader but ingested by Gemini when it summarised the message.
Was any data stolen?
No data exfiltration in this case; the harm is social-engineering. It's an output-handling failure — untrusted content shaping trusted-looking output.
Sources
- Phishing For Gemini — 0DIN
- Google Gemini flaw hijacks email summaries for phishing — BleepingComputer
- Google Gemini Tricked Into Showing Phishing Message Hidden in Email — SecurityWeek