Phishing Emails Hide Prompt Injections to Manipulate AI Assistants

Barracuda research describes phishing emails designed to deceive both human recipients and AI assistants processing their inboxes. Attackers conceal indirect prompt-injection instructions in HTML comments, invisible styled text, encoded content, and zero-width characters to influence assistants’ summaries and recommendations. The instructions attempt to portray malicious messages as legitimate or urgent; one example sought to make a summarizing assistant recommend changing a vendor’s payment details, potentially redirecting payments to an attacker-controlled account.

Exposure depends on how an assistant processes email, while broader permissions could increase the risk of unauthorized actions or sensitive-data disclosure. The reports do not establish that these attempts successfully caused fraudulent payments or data disclosure. Recommended safeguards include filtering hidden content, limiting assistant permissions, independently verifying sensitive requests—especially payment-detail changes—and requiring meaningful human approval for high-impact actions.