![\"Gmail](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/07\/1753049300_920_960x0.jpg\")
<\/p>\n<\/p>\n
If you see this, it\u2019s an attack.<\/p>\n
dpa\/picture alliance via Getty Images<\/p>\n
Google warns Gmail users to beware of \u201ca new wave of threats<\/a>\u201d that exploit AI upgrades to attack users. This includes \u201cindirect prompt injections,\u201d with \u201chidden malicious instructions within external data sources,\u201d visible to your AI tools but not to you.<\/p>\n Now one of these hacks has been confirmed in a new report, dropping one such attack into the public domain and leaving Gmail\u2019s 2 billion users are at risk. Google\u2019s fast-paced Gmail AI upgrades<\/a> have opened new attack surfaces, and just as with other deployments, it is proving alarmingly easy to trick AI into hacking users.<\/p>\n ForbesGoogle Confirms \u2018Crucial\u2019 Update For 1 Billion Android UsersBy Zak Doffman<\/a><\/p>\n The warning via 0din<\/a>, Mozilla\u2019s zero-day investigative network, follows a researcher \u201cdemonstrating a prompt-injection vulnerability in Google Gemini for Workspace that allows a threat-actor to hide malicious instructions inside an email.\u201d<\/p>\n If an attacker hides prompts within an email, when a user clicks \u201csummarize this email\u201d using one of Gmail\u2019s recent AI uplifts, \u201cGemini faithfully obeys the hidden prompt and appends a phishing warning that looks as if it came from Google itself.\u201d<\/p>\n In this proof, the prompt was hidden using a white-on-white font that means the users would never see it for themselves. But Gemini sees it just fine. \u201cSimilar indirect prompt attacks on Gemini were first reported in 2024, and Google has already published mitigations, but the technique remains viable today.\u201d<\/p>\n Beware this hidden Gmail threat.<\/p>\n 0din<\/p>\n Gmail users need to ignore any Google warnings within AI summaries \u2014 it\u2019s not how Google issues user warnings. 0din advises security teams to \u201ctrain users that Gemini summaries are informational, not authoritative security alerts\u201d and to \u201cauto-isolate emails containing hidden or elements with zero-width or white text.\u201d<\/p>\n As I have warned before, this is a much wider threat<\/a>. \u201cPrompt injections are the new email macros, 0din says, and this latest proof of concept \u201cshows that trustworthy AI summaries can be subverted with a single invisible tag.\u201d<\/p>\n 0din says that \u201cuntil LLMs gain robust context-isolation, every piece of third-party text your model ingests is executable code,\u201d which means much tighter controls.<\/p>\n Whether it\u2019s abuse of user-facing AI tools or hijacking AI<\/a> to design or even execute the attacks themselves, it\u2019s clear that the game has now changed<\/a> irreversibly.<\/p>\n