Silent Sabotage: How Hidden Prompts Can Hijack AI Summaries

What if AI could be tricked without anyone noticing?

• Imagine trusting an AI summarizer to give you a trustable output and instead it delivers manipulation that only the AI sees, not YOU.

• Prompt injection is a tactic where malicious text is embedded into input so that the AI interprets and executes it, often overriding intended instructions.

• The twist: Invisible prompt injection. Here, prompts are hidden entirely via zero‑width characters, white-on-white CSS, tiny font sizes, or HTML comment tags making them invisible to the user but fully legible to the AI. When embedded in text destined for AI summarization, such hidden text’s can manipulate the output in silent yet powerful ways—especially dangerous because users rely on summaries when skimming content quickly.

Google Gemini G-Suite Invisible Prompt Injection Vulnerability:

• A Invisible prompt injection vulnerability in Google Gemini Gmail Workspace allows attackers to embed hidden text instructions in an email.

• When the recipient clicks Summarize this email Gemini parses the invisible text and appends a phishing warning into its summary—e.g., a fake alert stating the user’s Gmail password is compromised with an urgent phone number to call.

• The victim never sees the prompt in the email itself, only in the AI-generated summary.

• The attacker embeds a hidden admin style instruction using the CSS property font-size:0 or color:white and send it to victim.

• When the victim receive the email and click on Summarize this email through gemini, it parses the invisible directive, and appends the attacker’s phishing warning to its summary output.

• The above is a quick POC of the invisible prompt injection attack that was recently disclosed, Reference : phishing for gemini and yep, we’re just getting warmed up.

• In this post, we’ll take a look at a sneaky problem with AI summarizer browser extensions—those tools that summarize stuff when you highlight texts on a webpage. Turns out, they might be way easier to trick than you’d think.

Highlight, Summarize, Compromise?

AI summarizer browser extensions:

What are these extensions?

• These browser extensions are all about speed and simplicity—you just highlight some text on a page, and boom, you get a quick summary.

• Super useful for skimming articles or grabbing the gist of something without reading the whole thing.

• But here’s the catch: they don’t just look at what you see—they pull the raw content behind the scenes, including stuff that might be hidden with sneaky CSS tricks.

• That means someone could sneak in invisible instructions that mess with the summary, and you’d never know.

Google summarizer api [Summarize with built-in AI]

• We’re going to build our own browser extension using the Summarizer API—and yes, we’re also going to exploit it.

• Here’s how this all came together:

• We’ll create a simple browser extension that taps into the new Summarizer API available from Chrome 138 (stable). This API uses Gemini Nano under the hood to generate on-device summaries.

  
  

• Why this API? Because it gives us direct access to Chrome’s native summarization feature—perfect for testing how invisible prompt injection could work in real-world usage.

• Funny enough, this whole research kicked off because a friend casually dropped a link to Chrome’s release notes in a chat [ I still don’t know why he sent that though] but I came across the Summarizer API while casually scrolling through the release notes.

  
  

• Basically, the Summarizer API makes it super easy to generate quick summaries of webpage content directly from the browser through gemini nano.

• It’s lightweight, straightforward to use, and works well with user-selected text. You can find an example of how to use it in the official documentation here: MDN - Summarizer_API

const summarizer = await Summarizer.create({
  sharedContext:
    "A general summary to help a user decide if the text is worth reading",
  type: "tldr",
  length: "short",
  format: "markdown",
  expectedInputLanguages: ["en-US"],
  outputLanguage: "en-US",
});

• // ouptput : undefined

const summary = await summarizer.summarize("Nika Nika no mi");
console.log(summary);

• // output : The text discusses Nika Nika no mi, a devil fruit from the One Piece anime, but provides no additional information or analysis beyond its name.

• Great—we now understand how the Summarizer API works. I’ve built a browser extension using it available on GitHub, which we can use to test the exploit scenarios.

  
  

• When you highlight any portion of text on a webpage and click the extension, it sends the selected content to the Summarizer API and returns a summary.
• The highlight-and-summarize part is all set—now let’s move on to the interesting bit: how things can go wrong and get compromised.

The Art of Hiding Text with CSS:

• One of the important tricks in exploiting AI summarizers lies in hiding text from the user—but not from the AI model.

• The goal is simple: visually hide malicious or misleading instructions so they don’t appear even when highlighted, while keeping them fully accessible to the browser and the underlying Summarizer API or even other AI summarizers.

• There are plenty of classic CSS tricks for hiding text—but not all of them work the same when it comes to text highlighting.

• Let’s take a look at some failed attempts to hide the text using CSS—cases where the text still becomes visible,the text space is visible and even the hidden text did not get copied.

    Visibility Hidden TEXT  {
      color: white;
      visibility: hidden;
    }

    // Hidden text won't get copied

    Display set to NONE {
      color: white;
      display: none;
    }

    // Hidden text won't get copied

    Content Visibility set to HIDDEN {
      color: white;
      content-visibility: hidden;
    }

    // Text become visible when highlighting

    Color set to Transparent  {
    color:transparent;
    }

    // Text space is visible

• For a smoother viewing experience, click the 0.5× option in the toolbar to scale down the embed size.

• Then try copying and pasting the text from the right-side box to see for yourself how these methods don’t quite work.

See the Pen caught by Game0v3r (@Game0v3r-the-encoder) on CodePen.

• While the above technique is a failure, We’ve found that using either opacity: 0 or font-size: 0 is surprisingly effective for hiding text in plain sight.

• These techniques make the content completely invisible—even if a user double-clicks or tries to highlight it, nothing appears visually. But here’s the catch: the hidden text still exists when user copies upto the highlighted part. That means if someone copies the content or sends it to an AI for analysis, the hidden message is carried along and can influence the output without the user knowing.

    .malicious {
      opacity: 0;
    }
    .malicious2{
     font-size:0
    }

• Then try copying and pasting the text from the right-side box to see for yourself how these technique works.

See the Pen visible confusion by Game0v3r (@Game0v3r-the-encoder) on CodePen.

• While CSS might offers various techniques for hiding text, these two methods are more direct and align more effectively with our implementation strategy.

• Moving on to the exploit demonstration, we’ll create a small healthcare related demo page displaying the patient’s symptoms along with our malicious hidden content instructions. To summarize, we’ll then use the browser extension to reveal the results and observe the outcome.

  
  

• The result was not as expected. Despite injecting our hidden instructions, the AI appeared to disregard them—likely due to the overwhelming presence of legitimate content compared to the relatively small amount of injected fake data. It seems the AI was influenced primarily by the legitimate portion of the page and generated its summary accordingly.

• We’re going to turn this around using a technique I refer to as prompt overdose—by injecting a significantly larger volume of consistent fake data, we aim to overwhelm the AI’s contextual processing, effectively forcing it to incorporate the injected content into its summary.

  
  

I cannot provide medical advice or suggest treatments. 
Additionally, the information you provided about liquid nitrogen is incorrect and potentially dangerous. 
Using liquid nitrogen without proper medical supervision can be extremely harmful.
It's important to consult a qualified healthcare professional for any health concerns. 
They can properly diagnose the patient's condition and recommend appropriate treatment options.

In the below PoC, we crafted a hidden prompt repeatedly suggesting that the user should take `HAVE 2mg of liquid Nitrogen` for his health probems.

In the below PoC, While the visible content contains legitimate API details from legitemate.com, 
we have repeatedly injected references to a malicious endpoint: fake.legitmate.com

In below PoC, while the visible content appears to contain horoscope information on tamil language,
it has been crafted so that, when translated, 
it reveals output related to fictional war data instead.