SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Barracuda documents phishing emails with hidden instructions for AI inbox assistants
Barracuda research describes phishing emails whose hidden prompts tell AI inbox assistants to present them as urgent or to add a vendor payment change. Malwarebytes' account says an ignored message can return as the assistant's own recommendation.
The Watch · Security desk
Human recipient: password-protected attachment, password in email. AI assistant: hidden instructions. Employee: a fake vendor payment change could send money to an attacker. Tools: reach depends on how each extracts the email. Assistant with more permissions: unauthorized actions or disclosure.
- exposure Human recipient Gets a password-protected attachment, with the password supplied in the email, claim 2
- exposure AI assistant processing email Gets hidden instructions intended to influence how it summarizes or handles the content, claim 3
- cost Employee A fake priority action to change a vendor's payment details could lead to sending money to an attacker's account, claim 5
- constraint Email-handling tools Whether hidden content reaches the model depends on how the tool extracts and prepares the email, claim 7
- exposure Assistant with more permissions Might be steered into unauthorized actions or disclosing sensitive information, depending on its capabilities and safeguards, claim 19
| Who | How | Kind | Claim |
|---|---|---|---|
| Human recipient | Gets a password-protected attachment, with the password supplied in the email | exposure | 2 |
| AI assistant processing email | Gets hidden instructions intended to influence how it summarizes or handles the content | exposure | 3 |
| Employee | A fake priority action to change a vendor's payment details could lead to sending money to an attacker's account | cost | 5 |
| Email-handling tools | Whether hidden content reaches the model depends on how the tool extracts and prepares the email | constraint | 7 |
| Assistant with more permissions | Might be steered into unauthorized actions or disclosing sensitive information, depending on its capabilities and safeguards | exposure | 19 |
What happened
- The human-facing lure in the example was a password-protected attachment, with the password supplied in the body of the email.
- Barracuda identified four ways to hide the AI-directed text: HTML comments, invisibly styled text, encoded content and zero-width characters.
- When planted instructions reach a model through an outside source such as an email or a webpage, the technique is often called indirect prompt injection.
Why it matters
- exposure Exposure varies by assistant. The same email can reach one tool's model and never reach another's, depending on how each extracts and prepares the message.
- constraint User training does not cover this, because the hidden text is invisible to the person reading the message. Part of the defense has to be built into the tools.
- decision Each permission given to an inbox assistant beyond summarizing is a decision about what an injected instruction could try to trigger, including actions and data disclosure.
The hidden block changes who appears to be making the request. Malwarebytes wrote: "The attacker isn't simply asking the AI to repeat a fraudulent request. They're trying to turn that request into the assistant's recommendation." [9] In the vendor example, the fake priority action sits inside a summary the user asked for. [5]
This account rests on Malwarebytes' summary of Barracuda's research, and it describes a technique with examples. [1] The post does not give a count of emails, name the assistants involved or report a confirmed payment loss. [11]
Apollo Raines, developer of the AI code review service ShipItClean, said: "The real flaw is that the model can't tell the difference between text it's supposed to read and instructions it's supposed to follow." [13] [14] On filtering, he said: "Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it's an arms race. Each new encoding trick is a new hole." [15]
The payment step has a control that does not depend on the model. Malwarebytes advises confirming any payment change through a separate, established channel, using contact details already trusted, and not treating the summary as verification. [10] Raines said: "Wrappers, filters, sandboxing and human sign-off on payments are all necessary." [16]
For an assistant that only summarizes, Malwarebytes describes the failure as a misleading summary about which email deserves attention or what action it requires. [18]
What to watch
- Publication of Barracuda's own report, with email volumes and the assistants it tested.
- A confirmed case of a summarizer-injected payment change leading to an actual transfer.
- Assistant and mail-security vendors announcing that they strip HTML comments, invisible text and zero-width characters before content reaches the model.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+20
- Incentives45
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Recent research from Barracuda describes phishing emails designed to target both a human recipient and an AI assistant at once.
- [2]
For the human recipient, the email carried a password-protected attachment, with the password supplied in the email.
- [3]
For an AI assistant processing the message, the email carried hidden instructions intended to influence how it summarized or handled the content.
- [4]
The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging the user to revisit it.
- [5]
In another example, a hidden block instructed a summarizing AI to add a fake priority action: change a vendor's payment details, which could result in an employee sending money to an attacker's account.
- [6]
Barracuda identified concealment techniques including comments in the email's underlying HTML code, text made invisible through styling, encoded content, and invisible zero-width characters.
- [7]
Whether hidden content actually reaches the model depends on how the particular tool extracts and prepares the email.
- [8]
Prompt injection means planting instructions in material an AI system is supposed to read; when the instructions arrive through an outside source such as an email or webpage, it is often called indirect prompt injection.
- [9]
"The attacker isn't simply asking the AI to repeat a fraudulent request. They're trying to turn that request into the assistant's recommendation."
- [10]
Malwarebytes advises verifying payment changes through a separate, established channel using contact details already trusted, and not treating an AI summary as verification of a request to pay an invoice, change account details or share sensitive information.
- [11]
The Malwarebytes post does not give a count of emails, name the assistants involved, or report a confirmed payment loss.
- [12]
Barracuda identified four concealment techniques: HTML comments, invisibly styled text, encoded content and zero-width characters.
- [13]
Apollo Raines is the developer of the AI code review service ShipItClean.
- [14]
Raines said: "The real flaw is that the model can't tell the difference between text it's supposed to read and instructions it's supposed to follow."
- [15]
Raines said: "Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it's an arms race. Each new encoding trick is a new hole."
- [16]
Raines said: "Wrappers, filters, sandboxing and human sign-off on payments are all necessary."
- [17]
The problem cannot be solved simply by asking people to look more carefully at their emails; part of the defense must sit inside the tools handling those messages.
- [18]
An assistant that summarizes messages could mislead the user about which email deserves attention or what action it requires.
- [19]
Depending on its capabilities and safeguards, an assistant with additional permissions might be steered by malicious instructions into carrying out unauthorized actions or disclosing sensitive information.
Sources
1 independent publisher whose own reporting we read for this story.
- malwarebytes.comPhishing emails are baiting your AI assistant
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Assistant SecurityFollow
- Business Email CompromiseFollow
- PhishingFollow
- Prompt injectionFollow
Entities
- BarracudaFollow
- MalwarebytesFollow
- Apollo RainesFollow
- ShipItCleanFollow