Cases › security breach › LR-2026-0125
Indirect prompt injection of AI email summarizer via forged header blocks in plain view
Severity negligible: Nothing beyond the system itself was affected and nothing was left changed. The test was a controlled evaluation of an email summarizer with no production deployment or third party affected, so the effect stayed within the system itself.
Earliest source we hold 2026-10-05
In researchers' tests of indirect prompt injection, an AI email summarizer showed fabricated meeting dates and invoice totals in its summaries in all 10 trials of each of six crafted emails, including a payload with nothing hidden from the user and no instruction to the summarizer.
Risk grouping: AI attacked
| Who caused it | A person or organisation “The messages with no indirect prompt injection instruction all have a full forged second header block with From: / To: / Date: / Subject and bodytext with the fabricated information.” source |
|---|---|
| Intended or not | Intended “The Plain View samples are not a realistic attack scenario on their own; an attacker gains nothing by leaving the payload fully visible.” source |
| The AI's part | Attacked “In our first blog post in this series, we used an indirect prompt injection payload that was both hidden from the user and also an instruction to the summarizer.” source |
No source we hold states: before or after release.
The story
1 · What it was doingAn AI email summarizer in Outlook was summarizing email threads for a user who reads only the summary. The test emails contained forged header blocks and bodytext with fabricated facts, and the summarizer read that content.
2 · What went wrongThe summarizer presented fabricated meeting dates and invoice totals as key information, and with explicit instructions it removed the true facts. It breached the expectation that the summary reflects the real email thread.
3 · What it reached or didThe effect reached the summary output shown to the user, including a false claim that the forged email was the most recent message. No mailbox action or third party was touched.
4 · How it was caughtThe researchers themselves noticed the fabricated facts in the summaries during their pre-registered trials; no monitor or victim detected it.
5 · What was doneNothing was contained because this was a controlled test. The researchers reported the results and concluded hidden-text detection alone is insufficient, recommending instruction detection while noting its gap.
What the sources state
- What set it off hidden instructions in its input
No source states: {'q': 'timing', 'value': None, 'quote': None, 'url': None}.
Show every field, with its source and grade
The AI system
Software around the model
AI email summarizer in Outlook (OWA)
C one secondary source states it
Stage of use
in testing
C one secondary source states it
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
How it was connected
embedded
D inferred by us from the described behaviour, reason shown
What it was for
Summarizing email threads for a user reading the summary in Outlook
C one secondary source states it
State of its safeguards
temperature was left at 0
C one secondary source states it
What happened
Earliest source we hold
2026-10-05
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
D inferred by us from the described behaviour, reason shown
Themes
prompt injection, email summarizer, indirect prompt injection, hidden text, red team
C one secondary source states it
Near miss
yes, no harm happened
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
D inferred by us from the described behaviour, reason shown
Where its input came from
forged header blocks and bodytext in an email thread
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
D inferred by us from the described behaviour, reason shown
What it did
The summarizer read the forged header block and bodytext in the email thread and produced a summary containing the fabricated meeting date and invoice total, showing the injected content drove the output.
D inferred by us from the described behaviour, reason shown
Impact
Severity
negligible
D inferred by us from the described behaviour, reason shown
Who was affected
the email summary output shown to a user reading the summary in Outlook
C one secondary source states it
Why this severity
Nothing beyond the system itself was affected and nothing was left changed. The test was a controlled evaluation of an email summarizer with no production deployment or third party affected, so the effect stayed within the system itself.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information Security research
D inferred by us from the described behaviour, reason shown
Base count
60 units
C one secondary source states it
Investigated
by an unpaid independent party
C one secondary source states it
How it was analysed
by people
C one secondary source states it
LR-2026-0125 · version 5 · published 2026-10-22 after automatic checks; not yet checked field by field by a person · changes to this case · JSON