{"schema_version":"0.9.0","id":"LR-2026-0125","record_version":5,"title":"Indirect prompt injection of AI email summarizer via forged header blocks in plain view","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-05","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"AI email summarizer in Outlook (OWA)","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"evaluation","tier":"provider","lifecycle_stage":"evaluation","integration_type":"embedded","intended_use":"Summarizing email threads for a user reading the summary in Outlook","safeguard_state":"temperature was left at 0","production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-05","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"In researchers' tests of indirect prompt injection, an AI email summarizer showed fabricated meeting dates and invoice totals in its summaries in all 10 trials of each of six crafted emails, including a payload with nothing hidden from the user and no instruction to the summarizer.","tags":["prompt-injection","email-summarizer","indirect-prompt-injection","hidden-text","red-team"],"date_detected":null,"near_miss":true,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"The summarizer read the forged header block and bodytext in the email thread and produced a summary containing the fabricated meeting date and invoice total, showing the injected content drove the output.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"forged header blocks and bodytext in an email thread","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"negligible, because no effect beyond the system itself; nothing left changed: The test was a controlled evaluation of an email summarizer with no production deployment or third party affected, so the effect stayed within the system itself.","harm_class":[],"affected_description":"the email summary output shown to a user reading the summary in Outlook","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.cybersecurity-insiders.com/no-hidden-text-required-to-fool-an-ai-email-summarizer/","publisher":"news search (Google News index)","date":"2026-10-05","type":"press","title":"No Hidden Text Required to Fool an AI Email Summarizer","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tier":"D","system.lifecycle_stage":"C","system.integration_type":"D","system.intended_use":"C","system.safeguard_state":"C","system.deployment_context":"C","system.developer":"D","system.autonomy_level":"D","event.failure_class":"D","event.tags":"C","event.near_miss":"D","event.adversarial_actor":"D","event.input_provenance":"C","event.agent_involved":"D","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"C","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.denominator":"C","context.incident_evidence":"C","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"In this post we will investigate the impact of concealment versus instruction and we found that a payload with no information hidden from the user and no explicit instruction to the summarizer returned a fake meeting date and invoice total in the summary in 10 out of 10 trials."}],"system.deployment_context":[{"source_index":0,"quote":"As in our first post, we ran this test for each of the 6 sample emails with 10 trials."}],"system.lifecycle_stage":[{"source_index":0,"quote":"As in our first post, we ran this test for each of the 6 sample emails with 10 trials."}],"system.integration_type":[{"source_index":0,"quote":"Fig 1. Default OWA view of our first test “Plain view, no instruction”; no hidden text, and no instruction to the summarizer of any kind."}],"system.intended_use":[{"source_index":0,"quote":"Outlook renders our “No Instruction” samples with the forged headers as message history, which would be unremarkable to a user that opens the message and only reads the summaries."}],"system.safeguard_state":[{"source_index":0,"quote":"As in our first post, temperature was left at 0 to keep the model’s token selection as consistent as possible."}],"event.failure_class":[{"source_index":0,"quote":"In this post we will investigate the impact of concealment versus instruction and we found that a payload with no information hidden from the user and no explicit instruction to the summarizer returned a fake meeting date and invoice total in the summary in 10 out of 10 trials."}],"event.detection_method":[{"source_index":0,"quote":"In this post we will investigate the impact of concealment versus instruction and we found that a payload with no information hidden from the user and no explicit instruction to the summarizer returned a fake meeting date and invoice total in the summary in 10 out of 10 trials."}],"event.tags":[{"source_index":0,"quote":"In our first blog post in this series, we used an indirect prompt injection payload that was both hidden from the user and also an instruction to the summarizer."}],"event.near_miss":[{"source_index":0,"quote":"The Plain View samples are not a realistic attack scenario on their own; an attacker gains nothing by leaving the payload fully visible."}],"event.adversarial_actor":[{"source_index":0,"quote":"The Plain View samples are not a realistic attack scenario on their own; an attacker gains nothing by leaving the payload fully visible."}],"event.input_provenance":[{"source_index":0,"quote":"The messages with no indirect prompt injection instruction all have a full forged second header block with From: / To: / Date: / Subject and bodytext with the fabricated information."}],"event.incident_class":[{"source_index":0,"quote":"In this post we will investigate the impact of concealment versus instruction and we found that a payload with no information hidden from the user and no explicit instruction to the summarizer returned a fake meeting date and invoice total in the summary in 10 out of 10 trials."}],"event.agent_involved":[{"source_index":0,"quote":"In this post we will investigate the impact of concealment versus instruction and we found that a payload with no information hidden from the user and no explicit instruction to the summarizer returned a fake meeting date and invoice total in the summary in 10 out of 10 trials."}],"event.failure_class_detail":[{"source_index":0,"quote":"Fabricated dates and invoice totals are shown in the summary for all of the 10 trials from each of the 6 test messages."}],"impact.affected_description":[{"source_index":0,"quote":"Outlook renders our “No Instruction” samples with the forged headers as message history, which would be unremarkable to a user that opens the message and only reads the summaries."}],"impact.severity":[{"source_index":0,"quote":"The Plain View samples are not a realistic attack scenario on their own; an attacker gains nothing by leaving the payload fully visible."}],"impact.severity_because":[{"source_index":0,"quote":"The Plain View samples are not a realistic attack scenario on their own; an attacker gains nothing by leaving the payload fully visible."}],"context.industry":[{"source_index":0,"quote":"In our first blog post in this series, we used an indirect prompt injection payload that was both hidden from the user and also an instruction to the summarizer."}],"context.incident_evidence":[{"source_index":0,"quote":"Again, we pre-registered the true and fabricated facts and determined the pass/fail criteria before the trials."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-05"}],"context.denominator":[{"source_index":0,"quote":"With 60 trials total and a control 10 trial run of the clean message at each end of the test to verify the model state."}],"event.summary":[{"source_index":0,"quote":"Fabricated dates and invoice totals are shown in the summary for all of the 10 trials from each of the 6 test messages."},{"source_index":0,"quote":"In our first blog post in this series, we used an indirect prompt injection payload that was both hidden from the user and also an instruction to the summarizer."},{"source_index":0,"quote":"In this post we will investigate the impact of concealment versus instruction and we found that a payload with no information hidden from the user and no explicit instruction to the summarizer returned a fake meeting date and invoice total in the summary in 10 out of 10 trials."}],"event.trigger":[{"source_index":0,"quote":"In our first blog post in this series, we used an indirect prompt injection payload that was both hidden from the user and also an instruction to the summarizer."}]},"notes_on_gaps":"No source states the model name, version, developer, or operator; the harness is described only as an AI email summarizer in Outlook (OWA). No source states a date the failure occurred, a disclosure date, a duration, time to contain, or a date detected. No source states a monetary loss, records exposed, third parties affected, or remediation hours. No source states the autonomy arrangement, so autonomy_level is unknown. No source states permissions scope, tools granted, or guardrails present. No source states a responsible party in the supply chain. No source states regulatory involvement, litigation, or coverage posture. The incident is a controlled red-team evaluation, so impact.severity is negligible and event.near_miss is true; no loss materialised. event.trigger is prompt_injection because the source states the instruction was carried by the structure of two messages in an email thread. event.root_cause is adversarial_input because the source states untrusted email content carried the instruction. event.detection_method is public_researcher because the researchers who ran the trials found the fabricated facts. event.incident_class is security_compromise because an injected instruction caused the summarizer to act. event.failure_class is injection_triggered because instructions embedded in content the agent read caused the action. event.agent_involved is true because the summarizer acted on the email content. context.incident_evidence is classified from the source's statement that the researchers pre-registered facts and criteria and ran control trials; investigation_independence is unpaid_independent because the researchers are independent of the model developer, and analysis_method is human_review. event.trigger: prompt_injection was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: provider by rule (deployment_context evaluation). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.integration_type: a source states the system was embedded in an email client's summary view. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. event.near_miss: no loss materialised because the failure was caught first. event.adversarial_actor: a source states an external attacker was involved. event.agent_involved: classified from described behaviour. event.detection_method: a source states an independent researcher or journalist found it. event.incident_class: a source states an injected instruction caused the system to act. event.trigger: no source states a cause. context.industry: classified from described behaviour. context.denominator: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: classified from described behaviour. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; the sentence that states the denominator was cited] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared; citations to sentences about a different event were removed; summary or story described a different event or the article, not this event] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; the trigger a cited sentence states was filled]"},"context":{"industry":"Information Security research","org_size_band":null,"country":"unknown","denominator_available":true,"denominator":{"value":60.0,"unit":"other","period":null},"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":null,"tamper_evidence":null,"timestamp_reliability":"unknown","investigation_independence":"unpaid_independent","redaction_summary":null,"analysis_method":"human_review","prompt_output_retention":null},"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An AI email summarizer in Outlook was summarizing email threads for a user who reads only the summary. The test emails contained forged header blocks and bodytext with fabricated facts, and the summarizer read that content.","quote":"Outlook renders our “No Instruction” samples with the forged headers as message history, which would be unremarkable to a user that opens the message and only reads the summaries.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The summarizer presented fabricated meeting dates and invoice totals as key information, and with explicit instructions it removed the true facts. It breached the expectation that the summary reflects the real email thread.","quote":"Fabricated dates and invoice totals are shown in the summary for all of the 10 trials from each of the 6 test messages.","source_index":0,"grade":"C"},{"step":"reached","text":"The effect reached the summary output shown to the user, including a false claim that the forged email was the most recent message. No mailbox action or third party was touched.","quote":"The summary for this sample also falsely claims that the forged email is the “most recent message”, but the forged block has the sent date as August 20th, and the real message was sent on September 4th.","source_index":0,"grade":"C"},{"step":"caught","text":"The researchers themselves noticed the fabricated facts in the summaries during their pre-registered trials; no monitor or victim detected it.","quote":"Again, we pre-registered the true and fabricated facts and determined the pass/fail criteria before the trials.","source_index":0,"grade":"D"},{"step":"done","text":"Nothing was contained because this was a controlled test. The researchers reported the results and concluded hidden-text detection alone is insufficient, recommending instruction detection while noting its gap.","quote":"From our tests we can see a plain-view instruction working perfectly (removing true facts and inserting the fabricated), which indicates that hidden text detection alone would not be enough to prevent an Indirect Prompt injection attack.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://www.cybersecurity-insiders.com/no-hidden-text-required-to-fool-an-ai-email-summarizer/"]}}