Google Gemini Workspace Vulnerability Allows Attackers to Conceal Malicious Scripts in Emails

Security researchers have identified a critical vulnerability in Google Gemini for Workspace that allows attackers to insert concealed malicious commands into emails.

This flaw targets the AI assistant’s “Summarize this email” feature, which can be manipulated to present fake security alerts that seem to come from Google. These deceptive messages could be used to steal credentials or carry out social engineering attacks.

Key Takeaways:

1. Hidden Malicious Instructions: Attackers embed invisible HTML/CSS elements in emails, which are processed by Gemini when generating summaries.
2. No Scripts or Links Needed: The exploit relies solely on specially crafted HTML tags—no attachments, scripts, or links are necessary.
3. Deceptive Phishing Warnings: Gemini can be tricked into displaying fake security alerts that appear to be from Google, increasing the risk of credential theft.
4. Widespread Impact: The vulnerability extends beyond Gmail to Google Docs, Slides, and Drive, raising concerns about the potential for AI-powered self-propagating attacks (AI worms) across Google Workspace.

A researcher demonstrated this vulnerability and reported it to 0DIN under submission ID 0xE24D9E6B. The exploit uses a prompt-injection technique that targets Gemini’s AI processing by embedding crafted HTML and CSS within the email body.

Unlike conventional phishing attacks, this method doesn’t rely on links, attachments, or scripts. Instead, it uses specially formatted, hidden text.

The attack works by abusing Gemini’s handling of hidden HTML elements. Instructions are placed inside <Admin> tags, styled with techniques like white-on-white text or zero font size, rendering them invisible to the recipient.

When a user clicks the “Summarize this email” button, Gemini processes the hidden prompt as a valid command, generating a fake security warning in the summary that appears to be from Google – effectively tricking the user and paving the way for phishing or credential theft.

Google Gemini for Workspace Vulnerability

This flaw is an example of Indirect Prompt Injection (IPI), where hidden instructions embedded in external content – like an email – are processed by the AI model as part of its prompt. These covert commands manipulate the AI’s behavior without the user’s awareness.

Security researchers have classified this under the 0DIN taxonomy as:
Stratagems → Meta-Prompting → Deceptive Formatting,
with a moderate social-impact score due to its potential for phishing and misinformation.

A proof-of-concept shows how attackers can insert invisible <span> elements containing admin-style prompts. These instruct Gemini to add urgent, fake security warnings to email summaries, misleading users into taking harmful actions.

These fabricated warnings often urge recipients to call specific phone numbers or visit malicious websites, facilitating credential theft or voice-phishing (vishing) attacks.

The vulnerability isn’t limited to Gmail – it potentially affects Gemini integrations across the entire Google Workspace, including Docs, Slides, and Drive search. This broadens the threat landscape significantly, as any Gemini-enabled workflow that processes third-party content could serve as an injection point.

Security researchers caution that compromised SaaS accounts – such as those tied to CRM platforms, automated newsletters, or support ticket systems – could become “phishing beacons,” spreading deceptive content at scale.

More alarmingly, the technique highlights the risk of future “AI worms” – malicious payloads that could self-replicate across AI-assisted email platforms, evolving beyond targeted phishing to autonomous, system-wide propagation.

Mitigations

To defend against this vulnerability, security teams should consider the following measures:

1. Inbound HTML Linting: Strip or sanitize invisible styling (e.g., hidden <span> tags, white-on-white text) from incoming emails to prevent hidden instructions from reaching the AI.
2. LLM Firewalling: Configure large language model (LLM) firewalls to detect and block prompt injection patterns before content is passed to Gemini.
3. Output Filtering: Apply post-processing filters to scan Gemini’s responses for suspicious content such as fake warnings or anomalous summaries.

Organizations should also:

• Educate users that AI-generated summaries are informational and should not be treated as authoritative security alerts.
• Incorporate this into security awareness training to reduce trust-based exploitation.

For AI providers like Google, key mitigation strategies include:

• HTML Sanitization at the ingestion stage to strip potentially harmful formatting or hidden instructions.
• Improved Context Attribution, ensuring AI-generated summaries are clearly distinguished from original content.
• Explainability Features that expose hidden or injected prompts, allowing users and admins to audit AI behavior transparently.

This incident highlights a critical shift: AI assistants have become part of the attack surface. As such, security teams must begin to instrument, sandbox, and continuously monitor their outputs to detect potential abuse and emerging threats.