Phishing emails are being designed to influence both the person who receives them and the AI assistant that processes them. The article cites recent Barracuda research describing messages that combine a password-protected attachment for the human recipient with hidden instructions intended to alter an assistant’s summary or handling of the email. In one example, the instructions could make a suspicious message appear legitimate or urgent; another told a summarizing AI to add a fake priority action to change a vendor’s payment details, potentially directing an employee’s money to an attacker. This technique is indirect prompt injection: instructions are embedded in outside material that the model is asked to read, rather than supplied directly by the user. Attackers can conceal them in HTML comments, invisible styled text, encoded content, or zero-width characters, although whether the model receives them depends on how the tool extracts email content. The article argues that asking people to inspect messages more carefully is insufficient because users may trust an assistant’s recommendation. Suggested defenses include stripping hidden content, filtering and sandboxing, limiting permissions, requiring human approval for payments and other high-impact actions, and checking the original email through a separate trusted channel before acting on sensitive recommendations.
