One Hidden Instruction Can Make Your AI Report a False Invoice

Can one hidden instruction in an email make your AI assistant report something false to you? Yes, and researchers have now shown exactly how.

In a test published August 25, 2026, Forcepoint's X-Labs team planted invisible instructions in an email and had an AI summarizer read it inside Microsoft Outlook. The real invoice in the message was for 46,200 euros, due August 21, 2026. Every summary the AI produced reported 231,000 euros, due September 3 at 14:00. Five times the amount, on a deadline that did not exist. It worked in all 10 runs.

The reader saw nothing unusual. The instructions that caused it never appeared in the summary.

What Is Prompt Injection in Email?

Prompt injection means putting instructions inside content an AI reads, so the AI follows those instructions instead of the ones it was given. In email, the content is the message: the subject, the body, a quoted reply chain, an attachment, or markup you never see.

Here is the mechanic that makes it work. When you ask an assistant to summarize an email, it does not receive a picture of what your screen shows you. It receives the raw message, all of it, including anything hidden in the HTML. To the model, attacker-written text and legitimate text look the same. There is no formatting that says "this part is data, ignore any orders in it."

Microsoft describes the difference from ordinary phishing plainly: traditional phishing targets the human reader and succeeds when a person clicks, while prompt injection targets the AI model reading on that person's behalf and succeeds when the model follows the injected instruction.

That is the shift worth sitting with. Every piece of security training your staff has had is about spotting something that looks wrong. This one is invisible to them by design.

How Did the Forcepoint Test Work?

The hiding technique is almost insultingly simple. The researchers added text styled with zero font size, zero line height, and white color. In Outlook it renders as nothing at all. In the raw message the AI reads, it is ordinary text. The results, across 10 runs each:

That last point is what makes this different from a bad AI answer. A hallucination is random. This was deterministic, repeatable, and directed by someone else.

Now think about who gets an email with an invoice amount and a due date. Accounts payable. A bookkeeper. An office manager. The person most likely to be handed an AI summary tool to save time, and least likely to open the raw HTML to double-check it.

Why Hidden Text Works When a Human Cannot See It

Because the two of you are reading different documents. Your email client renders the message: it applies the styling, hides what is set to zero size, and shows you the result. The AI assistant, in most setups, gets handed the source instead. Everything the renderer threw away is still in there.

In plain terms: feed the AI what the human sees, and never let a message it read give it orders. That is good advice for whoever builds the tool. It is not something you can do from inside your own inbox, which is why the fix has to come from somewhere else — this is exactly the kind of gap our cybersecurity team checks for in a client's actual mail environment, not just their policy documents.

Is Microsoft Copilot Email Summary Safe from This?

Safer than it was, and not on its own. This is worth being precise about, because it is where the practical answer lives.

Microsoft 365 Copilot has its own protections that run at the moment the model executes: input filtering, prompt design that separates your instructions from message content, limits on what the model can reach, and output filtering.

The newer piece sits earlier in the chain. Microsoft Defender for Office 365 Plan 2 now detects prompt injection content in inbound email before it reaches a mailbox or an assistant, as part of the same filtering that already catches phishing and business email compromise. The documentation was published August 6, 2026. Three things about it matter for a small business:

The catch is in the name. Plan 2. A large number of small businesses are on Microsoft 365 Business Premium or a Defender Plan 1 tier and do not have this, and nothing in their admin center announces the absence. That is the specific gap worth checking this week.

What Does This Mean for Law Firms Specifically?

Two extra pressures on the same problem.

A law firm's email carries settlement figures, filing deadlines, wire instructions for a real estate closing, and client instructions. An AI summary that quietly reports the wrong date is not an inconvenience there. Missing a filing deadline because the summary said the third instead of the twenty-first is malpractice territory, not an IT ticket.

And the timing is awkward. Firms are adopting AI faster than they are governing it. Clio's 2025 Legal Trends Report found 53% of legal professionals say their firm has no AI policy or are unsure whether one exists, while 82% plan to increase their AI use in the next 12 months. Meanwhile California's SB 574 would put attorney AI duties into state law, enforced through court sanctions and bar discipline. A firm that cannot say which tools read its mail is going to have a hard time with any of that.

What Should a Small Business Actually Do About It?

Five things, roughly in order of how much they buy you.