That Phishing Email You Ignored? Your AI Assistant Might Not Have.
October 19, 2026
On October 12, Pieter Arntz at Malwarebytes wrote up research from Barracuda about a new kind of phishing email. A week later, the headlines have moved on, but the problem it describes is still sitting in a lot of inboxes. These emails are written to fool two readers at once: the person who gets the message, and the AI assistant that summarizes the inbox for them.
Picture it this way. You spot a suspicious email and leave it alone. You don't click, open the attachment or reply. Later, you ask your AI assistant to sum up what needs your attention today. The email you wisely skipped shows up again, this time as an urgent recommendation from a tool you trust.
What the attackers are actually doing
In one example from the research, a hidden block of text told the summarizing AI to add a fake priority action: change a vendor's payment details. An employee who trusts that summary could end up sending money straight to an attacker's account. As the Malwarebytes piece puts it, the attacker isn't just asking the AI to repeat a fraudulent request. They're trying to make that request look like the assistant's own recommendation.
The technique is called indirect prompt injection. Attackers plant instructions inside something the AI is supposed to read, like an email or a webpage, and hope it follows them instead of treating them as ordinary content. Barracuda found several ways to hide those instructions:
- Comments tucked into the email's underlying HTML code
- Text made invisible with styling
- Encoded content
- Invisible "zero-width" characters
A person looking at the email sees nothing unusual. The AI may still read all of it. Whether the hidden text actually reaches the model depends on how a given tool pulls in and prepares the email. That variability is part of the problem.
Why "look more carefully" isn't the answer
For years, the advice on phishing has been about training people to slow down and spot the warning signs. That still matters. But you can't spot text you can't see. The Malwarebytes article says it plainly: part of the defense has to sit inside the tools handling those messages.
That's the real issue for most small businesses. An assistant that only summarizes can steer someone toward the wrong email. An assistant that can also send messages, open files or move things around raises the stakes a lot. If it follows a hidden instruction, it could take actions nobody approved or share information it shouldn't.
The decision most offices skipped
Most offices we talk to turned on AI email helpers because they were included, convenient and genuinely useful. Very few stopped first to decide what those helpers are allowed to do. That's not a criticism. Settings like these tend to show up one update at a time, and nobody's job description says "go figure out the AI permissions."
Someone does need to own that decision, though. In practice, that means:
- Mapping the sticky workflows where an AI recommendation could turn into real money moving, like vendor payments, invoice approvals and banking changes.
- Matching each assistant's permissions to the job it's actually there to do, so a summarizer isn't quietly holding the keys to everything else.
- Building in a human sign-off on high-impact actions, with a check of the original request, not just the summary.
- Confirming payment changes through a separate, trusted channel, every time, no matter how official the recommendation looks.
None of this means pulling AI out of your office. These tools save real time. It means putting guardrails around them on purpose, so a well-crafted email can't turn your assistant into the attacker's messenger.
That's the work we do in our AI advisory engagements. We sit down with you, look at how work really moves through your business, and help decide where AI belongs, what it should be able to touch and where a person needs to stay in the loop. If you've already switched on AI email tools and never had that conversation, now is a good time.