A new study has shown how attackers can use hidden instructions in an email to manipulate AI assistants into generating false and potentially dangerous summaries for recipients.
The study, by researchers at Forcepoint X-Labs, is the latest example of how attackers can use indirect prompt injections to subvert AI systems and get them to behave in unintended ways when processing external content.
Multiple researchers have demonstrated variations of the issue, which stems from the inability of AI systems to reliably distinguish between data they are processing and instructions they are meant to follow. The problem is so pervasive that OWASP has consistently ranked prompt injection No. 1 in its list of Top 10 risks for LLM and generative AI applications since 2023.
A Contained Prompt Injection Experiment
For the proof-of-concept study, Forcepoint X-Labs built an isolated lab environment with synthetic data and an Outlook add-in that sent email headers and body text to an LLM-powered summarization service, using Claude Haiku 4.5 to generate the summaries. The researchers deliberately built a simple email-to-LLM pipeline without guardrails or safeguards that would have let the AI distinguish the email's content from instructions.