Gemini parses the invisible directive and appends the attacker’s phishing warning to its summary output. If the user follows the AI-generated notification and follows the attacker’s instructions, this leads to leaked credentials or a phone-based social engineering attack.

A security researcher discovered a way to trick the AI-generated email summary feature into promoting malicious instructions to unsuspecting users.