Google has warned its 1.8 billion Gmail users about indirect prompt injection: instructions hidden inside an email that Gemini reads and follows when someone asks it to summarize the message. After 25 years in enterprise security, I read it as the clearest public example yet of why filtering content does not secure AI. The problem is what the model is allowed to do next.
What the attack looks like
The demonstration came from Marco Figueroa, who runs Mozilla’s 0Din GenAI bug bounty program. An attacker writes an email with instructions hidden in the body using ordinary HTML tricks: a zero-size font, or white text on a white background. The recipient sees a normal message. Nothing in it trips a filter, because there is no bad link and no attachment.
Then the recipient clicks “Summarize this email.” Gemini reads the whole body, hidden text included, and treats the buried instructions as part of its job. In Figueroa’s proof of concept the summary came back with a fake Google security alert, complete with a support phone number for the victim to call.
The attacker touches nothing on Google’s side. They send an email and wait. That is what makes it indirect. The user did nothing wrong, and the model did what it was built to do: read text and act on it.
Why a filter cannot close this
A language model takes everything in its context as one stream of text, with no hard boundary between the instructions Google gave it and the content it was asked to read. A hidden sentence in an email lands in the same place as a legitimate request, and the model has to guess which is which.
OWASP ranks prompt injection number one in its Top 10 for LLM Applications and calls it unpatchable, because it comes from how these models work rather than from a bug someone can fix. It has held that spot from 2023 through 2025.
What Google has done
Google has been open about the limits here, which I respect. It has put five defenses around Gemini: classifiers trained to spot injection attempts, extra instructions around untrusted content to keep the model on task, markdown sanitization and URL redaction, blocked external image rendering, and user confirmation before sensitive actions.
With Gemini 2.5, Google reports attack success dropped from 99.8% to 53.6%. That is real progress and still a coin flip. Google says it has found no evidence of incidents manipulating Gemini in the wild, that the technique remains viable today, and that it is in the middle of deploying several updated defenses. It also initially classified some of the reported behavior as intended, which tells you how close this sits to the model’s normal function.
Where the control has to sit
Every one of those layers works on the same principle: read the words, decide whether they look dangerous. That is a filter. Filters are worth having, and they will keep losing ground, because the attacker gets unlimited tries at the wording.
Mountain Theory starts from a different place. Filters read words. We check the action an AI is about to take against policy before it runs, and return one of three answers: ALLOW, HOLD or BLOCK.
Under that model, a hidden instruction in an email is data, not a command. Gemini can read it. It can even summarize it. What it cannot do on its own is turn it into a send, a forward or an export, because that is where the policy check happens. The injected instruction fails at the point where it tries to become an action, not at the point where it is read.
That distinction matters more as assistants get permission to send mail, change calendars and move files instead of just describing them. A summary that lies to you is a phishing problem. An assistant that acts on the lie is an execution problem, and the fix belongs at the point of execution. Google’s numbers show what reading the words can achieve. The 53.6% that gets through is the case for checking the action.