Hidden prompt injections in emails put automated AI reading tools at risk

Cybercriminals are finding new ways to trick artificial intelligence assistants by hiding secret text inside everyday emails. Security researchers at Barracuda recently identified phishing messages containing commands that human readers cannot see, such as invisible characters or hidden web code. When an automated software tool scans these incoming emails to write a summary, it reads the secret text and can be manipulated into treating fraudulent messages as priority tasks.

This tactic presents a serious risk because many people who carefully spot normal phishing scams still trust recommendations generated by their AI tools. According to Malwarebytes, a manipulated summary could advise a worker to change bank details for a vendor, sending money directly to an attacker. As Apollo Raines, developer of ShipItClean, noted in the report, "the model can't tell the difference" between background reading material and actual commands it should execute.

Security experts agree that filtering hidden code is helpful, but attackers will constantly invent new ways to bypass basic checks. What remains unclear is whether engineers can update AI systems to recognize malicious prompts on their own, or if companies will be forced to restrict what AI software is allowed to do. If users give automated tools full authority to process financial tasks without manual oversight, the potential damage from these silent attacks will only increase.