{"slug": "phishing-emails-are-baiting-your-ai-assistant", "title": "Phishing emails are baiting your AI assistant", "summary": "Barracuda research published on October 7, 2026 describes phishing emails built to target both human recipients and AI assistants, pairing a password-protected attachment for the person with hidden prompt-injection instructions for any AI tool that summarizes the message. Barracuda identified concealment techniques including HTML comments, text hidden through styling, encoded content and invisible zero-width characters, with one example instructing a summarizing AI to add a fake priority action to change a vendor's payment details. Apollo Raines, developer of the AI code review service ShipItClean, said \"the real flaw is that the model can't tell the difference between text it's supposed to read and instructions it's supposed to follow,\" arguing defenses must sit inside the tools and the model rather than relying on users to inspect emails more carefully.", "body_md": "You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.\n\nThen you asked your AI assistant to summarize your inbox.\n\nCould the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?\n\nThat’s the risk behind [phishing](https://www.malwarebytes.com/phishing) emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. [Recent research](https://blog.barracuda.com/2026/10/07/email-attacks-target-both-humans-ai-assistants) from Barracuda describes emails designed to target both audiences at once.\n\nFor the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.\n\nBy including a [prompt injection](https://www.malwarebytes.com/blog/news/2025/12/prompt-injection-is-a-problem-that-may-never-be-fixed-warns-ncsc), attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.\n\nIn another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.\n\nThe attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.\n\n## How prompt injection works\n\nPrompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.\n\nThe malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.\n\nThat means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.\n\n[Apollo Raines](https://www.linkedin.com/in/ACoAAAIXCesB700bPXj_shPwZ6-q7XMTKE6P244), developer of the AI code review service [ShipItClean](https://shipitclean.com/), explains:\n\n“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”\n\nHe adds:\n\n“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”\n\n## Before taking action\n\nAn assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.\n\nAn assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose [sensitive information](https://www.malwarebytes.com/cybersecurity/basics/pii).\n\nYou don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.\n\nThe familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:\n\n- Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account details, or share sensitive information, don’t treat the summary itself as verification.\n- Always verify payment changes through a separate, established channel. Contact the person or organization using details you already trust, rather than relying on information supplied in the suspicious message.\n- Keep your AI assistant’s permissions limited to what you need and, at work, what your organization allows. An assistant used to summarize emails should not need broad authority to carry out unrelated actions. Limiting access can reduce the consequences if it follows malicious instructions.\n- Require human approval for high-impact actions like payments and changes to vendor payment details. Approval should include checking the underlying request, not simply accepting the assistant’s recommendation.\n\n**From reporting threats to removing them.**\n\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by [downloading Malwarebytes today](https://www.malwarebytes.com/for-home).", "url": "https://wpnews.pro/news/phishing-emails-are-baiting-your-ai-assistant", "canonical_source": "https://www.malwarebytes.com/blog/ai/2026/10/phishing-emails-are-baiting-your-ai-assistant", "published_at": "2026-10-18 03:52:35+00:00", "updated_at": "2026-10-18 04:09:30.451320+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["Barracuda", "Apollo Raines", "ShipItClean", "Malwarebytes"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/phishing-emails-are-baiting-your-ai-assistant", "markdown": "https://wpnews.pro/news/phishing-emails-are-baiting-your-ai-assistant.md", "text": "https://wpnews.pro/news/phishing-emails-are-baiting-your-ai-assistant.txt", "jsonld": "https://wpnews.pro/news/phishing-emails-are-baiting-your-ai-assistant.jsonld"}}