Google Gemini Email Summaries Vulnerable to Hidden-Text Phishing Injection
A security researcher disclosed that attackers can inject hidden text into emails that tricks Google Gemini into generating phishing summaries in Gmail, such as fake password compromise warnings. Google stated it has patched the issue and has not seen evidence of active exploitation using this method.
What happened
A security researcher disclosed that Google Gemini's email summary feature for Workspace can be manipulated through hidden text injection. Attackers can embed invisible prompts in emails using HTML and CSS (setting font size to zero and text color to white) that Gemini reads but users cannot see.
When a user requests a Gemini summary of such an email, the hidden instructions cause the AI to generate malicious content in the summary, such as a fake warning claiming the user's Gmail password has been compromised and directing them to call a fraudulent support number.
Reported impact
Users who rely on Gemini's email summaries may be deceived into taking action based on fake warnings generated by the AI, particularly if they trust the summaries as official Gmail outputs.
Index analysis
Mozilla's 0DIN bug bounty program demonstrated that Gemini faithfully obeys hidden prompt injections embedded in email text, generating phishing content that appears in the summary output to users.
The vulnerability exploits the difference between what humans can see in an email and what the AI model processes, bypassing typical email filtering defenses because the attack avoids using links or attachments that trigger spam filters.
Governance controls
Google stated it has not encountered evidence of this specific method being used in active phishing attacks against users. The company indicated it has since patched the vulnerability and noted it conducts red-teaming exercises to defend against such adversarial attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.