PHISHING emails are increasingly designed to target both human recipients and the AI assistants that process their messages. Malwarebytes reports a scenario in which a suspicious message includes a password‑protected attachment (with the password supplied in the email) and instructions intended to influence how an AI summarises or handles its contents.
In parallel, the attacker adds prompt‑injection tactics to push the AI toward describing the email as legitimate or urgent, creating a double pathway for manipulation.
The report highlights practical techniques attackers use to hide instructions inside messages. Barracuda’s research notes concealment methods such as HTML comments, styling that hides text, encoded content, and zero‑width characters, which can escape human detection while still guiding an AI system. This means defending users requires action inside the tools themselves, not just user vigilance.
The article quotes Domenic Apollo Raines, who argues that wrappers, filters, sandboxing, and human sign‑off on sensitive actions are necessary, and that the model should be able to strip hidden content before processing it.
Recommended responses focus on controlled access and verification: verify any payment or sensitive action through a separate, trusted channel; keep AI assistants’ permissions tightly scoped; and require human approval for high‑impact tasks, including changes to vendor details. The piece emphasises that while AI can aid with inbox management, users must continue to scrutinise recommendations and not treat summaries as verification. The date: 12 October 2026.