A critical flaw in Google Gemini lets hackers use hidden email commands to create AI-powered phishing attacks, turning the trusted summary feature into a weapon.