Webmail CSS flaws can trick connected AI tools

Published July 29, 2026

Carefully styled email content can interfere with webmail pages and connected AI tools. Demonstrations showed possible password theft, token theft, and misleading AI instructions.

Report priority
Medium
Targets
Gmail+6 more

How it works

  • An attacker sends email containing HTML and CSS that webmail allows through.
  • Differences between filtering and browser rendering can let that content interact with the surrounding webmail page.
  • In Gmail, researchers connected this behavior to an indirect prompt injection processed by Claude Cowork.
  • In OpenAI Atlas, hidden styling made the AI read different instructions from the human reader.

What to do

If you use Gmail with Claude Cowork connected, or OpenAI Atlas to read email, compare your setup with the researchers' documented scenarios. The reported Outlook label attack and Gmail image-request bypass still worked during testing on August 6, 2026.

Check current security guidance from Microsoft, Google, Anthropic, and OpenAI before connecting these tools to email. Fastmail had patched two reported CSS issues, while the Proton Mail bypass failed during retesting. The research did not establish one universal fix or fixed version for Outlook and Gmail.

Technical details

Affected software: Gmail, Outlook, Claude Cowork, Fastmail, Proton Mail, Yahoo Mail, AOL Mail

Webmail filters untrusted HTML and CSS, but browser rendering can differ from what those filters approved. Demonstrated effects included Outlook interface control, token theft through pasted email content, and indirect prompt injection against Claude Cowork through Gmail. Hidden CSS also made OpenAI Atlas interpret instructions differently from the human reader.

References

View Original Source