Prompt injection by email is text placed in a message for an AI assistant to obey. It is often hidden from the person, in white or zero-size type. When you ask Copilot, Gemini or ChatGPT to summarise or search your mail, the assistant reads that text too. It can change the summary, or make the assistant send your data elsewhere.
What is prompt injection in email?
OWASP, which publishes the standard list of risks for software built on language models, calls this indirect prompt injection. Content from an outside source, such as a web page, a file or an email, changes the model's behaviour once the model reads it. OWASP notes that the instructions do not need to be visible to a person. The US National Institute of Standards and Technology describes the same attack as one a third party mounts remotely, often against the primary user.
Email suits the attack well. Anyone can send you one, and an assistant connected to your mailbox reads every message as context. The assistant cannot reliably tell your request from instructions written by a stranger.
How the instructions are hidden
The documented cases use a handful of tricks:
- White or zero-size text. The 2025 Gemini case put its instruction at the end of the body in white text with a font size of zero. Gmail displayed nothing there.
- Markup the reader never sees. HTML and CSS can hide a block from the screen while leaving it in the message. The 2026 Copilot case used this.
- Invisible characters. Unicode tag characters display as nothing. A 2024 demonstration used them to hide stolen data inside a link that looked harmless.
- Plain prose. EchoLeak hid nothing at all. Its instructions read like a normal business email written to a person, which is how they passed Microsoft's filter.
Real cases: Copilot, Gemini and ChatGPT
Researchers have shown the attack against Copilot, Gemini and ChatGPT. Each finding was reported to the vendor and fixed.
- Microsoft 365 Copilot, 2024. Johann Rehberger showed an email that made Copilot search the mailbox by itself and hide the results in invisible characters inside a link.
- EchoLeak, 2025. One email, never opened, could make Copilot send internal data out when the user asked an ordinary question. It was rated critical and fixed on Microsoft's servers.
- Gemini in Gmail, 2025. Hidden text turned an email summary into a fake Google alert about a compromised password, with a phone number to call.
- ChatGPT Deep Research, 2025. Radware's ShadowLeak used hidden instructions in an email to make the agent send personal data from a Gmail inbox to an outside address. OpenAI fixed it.
- Copilot in Outlook, 2026. Hidden text made Copilot's summary display a fake "action required" security alert with a link.
The five cases share one pattern. The assistant speaks with the authority of the product it belongs to, so a scam that appears in its answer borrows that trust.
What the assistant makers do about it
Microsoft's security response team described its approach in July 2025. It hardens the instructions the assistant runs under, marks outside content so the model can tell it apart, uses classifiers to detect injection, and blocks the routes data leaves by, such as markdown images and untrusted links. Microsoft Defender for Office 365 Plan 2 also scans incoming mail for prompt injection, including hidden, invisible or off-screen text, before it reaches a user or an assistant.
Google described a layered defence for Gemini in June 2025: a model trained against injection, classifiers for injected content, removal of external images and suspicious links from answers, and confirmation before risky actions. The UK's National Cyber Security Centre warned in December 2025 that prompt injection may never be fully fixed the way SQL injection was, because language models do not keep instructions and data apart. It advises giving a model fewer privileges when it processes less-trusted content, such as outside email.
How to protect yourself when an assistant reads your mail
- Treat security alerts in a summary as unverified. A real warning about your account appears on the account's own security page. Go there by typing the address yourself.
- Do not follow links or call numbers that only appear in a summary. If the original email does not show them, ask why the assistant does.
- Give the assistant as little access as it needs. An assistant that cannot search every folder or send mail on its own has less to leak.
- Read the original before you act. A summary is a convenience, not a source. The seven checks for Gmail and Outlook apply to the message underneath.
What Antilure draws for hidden instructions
When a message carries text hidden from the reader and aimed at an assistant, Antilure draws a banner inside the email in Gmail or Outlook that says it contains hidden instructions aimed at AI assistants, with the advice not to let an assistant act on it. Download Antilure.
Sources
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project, 2025.
- Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST AI 100-2e2025, section 3.4, National Institute of Standards and Technology, March 2025.
- How Microsoft defends against indirect prompt injection attacks, Andrew Paverd, Microsoft Security Response Center, 29 July 2025.
- Prompt injection protection in Microsoft Defender for Office 365, Microsoft Learn, updated 10 September 2026.
- Mitigating prompt injection attacks with a layered defense strategy, Google GenAI Security Team, 13 June 2025.
- Prompt injection is not SQL injection (it may be worse), Dave Chismon, National Cyber Security Centre, 8 December 2025.
- Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information, Johann Rehberger, Embrace The Red, 26 August 2024.
- CVE-2025-32711, CVE Program record, Microsoft as numbering authority, 11 June 2025.
- Phishing For Gemini, Marco Figueroa, 0DIN (Mozilla), 10 July 2025.
- OpenAI plugs ShadowLeak bug in ChatGPT, Carly Page, The Register, 19 September 2025.
- CVE-2026-26133, CVE Program record, Microsoft as numbering authority, March 2026.