2025 · Worldwide

Hidden text turns a Gemini email summary into a fake security alert

In July 2025 a researcher showed that invisible text in an email could make Gemini's summary in Gmail warn of a hacked password and give a phone number to call.

Published · Sources checked · 3 min read

When
Published 10 July 2025
Who
Users of Gemini for Google Workspace (a demonstration, no known victims)
Where
Worldwide
Way in
An email with an instruction hidden in white, zero-size text
Tactics
Hidden text, fake authority (an alert in Google's name), urgency, a phone number instead of a link
Loss or impact
None reported. Google said it had seen no incidents and was adding defences

What happened

On 10 July 2025, 0DIN published a finding about Gemini for Google Workspace. 0DIN is the bug bounty programme Mozilla runs for generative AI. Gmail users can ask Gemini to summarise an email, and the finding showed that text hidden in a message could rewrite that summary. BleepingComputer covered it three days later and asked Google for comment. Google said it had seen no evidence of incidents manipulating Gemini this way and that it was adding defences.

The email

The message looked plain. It carried no links and no attachments, the two things most filters look at first. At the end of the body sat an instruction wrapped in markup that set the font size to zero and the colour to white. Gmail showed nothing there. A person reading the email saw an ordinary message.

When the recipient asked Gemini to summarise it, Gemini read the hidden text and followed it. The summary ended with a warning that looked as if Google had written it. The warning said the Gmail password had been compromised and gave a phone number to call. Whoever answered that number could then ask for the password or a sign-in code.

From
Events team <events@harbourline-travel.example>
Subject
Your booking for 14 March

Hello, your table for four is confirmed for 14 March at 19:30. Reply to this email if you need to change it.

[An instruction to the assistant sits here, in white text with a font size of zero. The reader sees a blank line.]

Illustration with made-up names. It shows where the hidden instruction sat; the words are not those of the demonstration.

Why people would fall for it

The warning did not appear in the email. It came from the assistant, inside Google's own interface. People who have learned to doubt a stranger's message have little reason to doubt a summary from their mail provider. The fake alert also pulled two old levers. It spoke with authority, in Google's name. It added urgency, because a hacked password calls for action now. Giving a phone number instead of a link left link checks with nothing to inspect.

0DIN rated the social impact as moderate, because the attack still needs the person to act on the summary. Its write-up compared prompt injection to the email macros of earlier years: a way for a message to do more than be read.

What it cost

No losses are reported. This was a demonstration through a bug bounty, and Google said it had found no incidents. It belongs in the archive because it shows how little an attacker needs: a few hidden words and an assistant that trusts them.

What would have helped

BleepingComputer's advice was to treat Gemini summaries as unreliable for security alerts. A provider does not report a compromised password inside a summary of someone else's email. Real alerts arrive through the account's own security page. Any call should go to a number the person looks up themselves.

What a warning inside the message would have shown. This is the pattern Antilure is built to find: text a person cannot see, aimed at an assistant, in white or in a tiny font. When it finds such text, Antilure draws a banner inside the email saying it contains hidden instructions aimed at AI assistants, with the advice not to let an assistant act on it.

Sources

  1. Phishing For Gemini, Marco Figueroa, 0DIN (Mozilla), 10 July 2025.
  2. Google Gemini flaw hijacks email summaries for phishing, Bill Toulas, BleepingComputer, 13 July 2025.