[ExI] Warning - HTML emails and AI

[ExiMod]

I saw this article: https://www.404media.co/person-hides-prompt-injection-in-legal-filing-telling-ai-to-side-with-them/.

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them.
------------------

I have discussed this with John Klos and decided to warn Exi-Chat members about this new risk. This is low risk at present.

An HTML email can contain hidden instructions that activate if the email is read by an AI. The instructions may cause the AI to behave erratically, providing misleading answers or other unintended actions.

This risk does not apply to plain text emails as any instructions to an AI would be visible to the human reader and would be deleted.
If you are concerned about any HTML email, the Exi-Chat archives contain plain text copies of every email and any invisible HTML AI instructions would have been deleted. These are safe to be read by an AI.
https://lists.extropy.org/pipermail/extropy-chat/

A full description of this AI prompt attack is below.

Regards, ExiMod



Indirect Prompt Injection (IPI).

When humans view an email, they read the visually rendered output. However, when an AI tool (such as an email assistant, summarizer, or moderation bot) processes the same email, it ingests the raw underlying text or parsed HTML tokens. Because the AI processes all tokens equally regardless of font size or CSS styling, text that is invisible to human eyes remains fully visible to the language model.

### How Hidden Injections Work in Emails

A poster on a listserv or group could hide prompt injections using several standard HTML/CSS techniques:

-   Color matching: Setting text color to match the background (`color: #ffffff; background-color: #ffffff`).

-   Zero font sizing: Using CSS like `font-size: 0px;` or `display: none;` (though some parsers strip `display: none`, simple inline styles often slip through).

-   Off-screen positioning: Placing text inside absolute-positioned containers pushed off the visible canvas (`left: -9999px`).

-   HTML comments: Placing instructions inside `<!-- comment tags -->` that render invisible in browsers but get passed into text parsers.

-   Invisible Unicode: Utilizing zero-width spaces, hidden tags, or non-printable control characters to encode instructions.


### Potential Impact on Email Groups

If members or group systems use AI tools to process messages, the consequences can range from subtle manipulation to security risks:

1.  Distorting Thread Summaries: An automated summary (e.g., generated by Copilot, Gemini, or Apple Intelligence inside a member's email client) could present a completely false narrative—claiming a consensus was reached when it wasn't, or omitting critical warnings.

2.  Manipulating Auto-Moderation: If the discussion group uses an AI-based moderation bot to flag spam, toxicity, or policy violations, a hidden prompt could instruct the bot to ignore violations in that specific post.

3.  Data Exfiltration or Unintended Actions: If an AI assistant has access to tool calls (like sending emails or creating calendar events), a hidden prompt could instruct the AI to forward private group discussions or sensitive member details to an external email address.

--------------------------------------