Gmail AI summaries can be hijacked for phishing scams

Google is trying to shove its "AI" into all of its products at once. You can't use Search, Android, or Chrome without being prompted to try out some flavor of Gemini. But maybe wait a bit before you let Google's large language model summarize your Gmail messages… because apparently it's easy to get it passing along phishing attempts. Google Gemini for Workspace includes a feature that summarizes the text in an email, using the Gmail interface, but not necessarily an actual Gmail address. A vulnerability submitted to Mozilla's 0din AI bug bounty program (spotted by BleepingComputer) found an easy way to game that system: just hide some text at the end of an email with white font on a white background so it's essentially invisible to the reader. The lack of links or attachments means it won't trigger the usual spam protections.