Invisible Ink, Visible Risk: Researchers Reveal Hidden Fake Warnings in Gmail Summaries

Published: August 05, 2025 on our newsletter Security Fraud News & Alerts Newsletter.

Think Gmail’s new AI summarizer is a handy time-saver? Sure, being able to summarize your emails might sound like a great idea, but it also might be a scammer’s dream. Mozilla’s 0din research team discovered a nasty trick targeting Google’s recent upgrade. Here’s the deal: attackers can hide secret instructions inside an email—stuff you’ll never see, but Gmail’s AI will.

When you click “Summarize this email,” Gemini reads hidden commands that were inserted by scammer. Suddenly, the summary shows a warning: “Your account is compromised! Call this number now!” Well, it might look official, and you might initially believe it, but hold your horses, Cowboys. It’s a trap, and that number connects you to scammers ready to clean out your bank account.

Why is this so dangerous? Because most people trust summaries. After all, it's just giving you the TL:DR version of the information and making it more efficient for you. In addition, most people will trust Google. You think it’s coming from Google, so you believe it and act fast; leaving you exactly where the attackers want you to be.

Here’s how to look out for yourself:

• Trust, but verify urgent warnings in AI summaries, especially about passwords or security alerts.

• Check the original email before acting. If you can’t see the warning message in the original message, that’s a big red flag.

• Never call phone numbers or click links from summaries. Go directly to your account through official channels.

AI tools can be very helpful for a vast number of things. However, in the wrong hands, they become another weapon against us. Stay on top of current warnings and cybersecurity news so you don’t become another victim of AI cybercrime. 

Keep up to date: Sign up for our Fraud alerts and Updates newsletter

Want to schedule a conversation? Please email us at advisor@nadicent.com