Malwarebytes Labs: Phishing Emails Use Hidden Prompt Injections to Target AI Inbox Summarizers
Attackers embed invisible instructions in spam to trick AI assistants into recommending fraudulent payment changes or urgent actions to users.
Key points
- Malwarebytes Labs reports phishing emails now contain hidden prompt injections aimed at AI assistants.
- Barracuda research shows attackers use invisible text and HTML comments to bypass human scrutiny.
- Apollo Raines warns that model-level defenses are needed because users trust AI tools more than email.
Malwarebytes Labs published research in October 2026 revealing that phishing campaigns are targeting AI assistants. Attackers embed hidden instructions within email content to manipulate how AI tools summarize inboxes. These prompts can trick assistants into presenting fraudulent requests as legitimate or urgent recommendations, bypassing traditional user skepticism.
In plain English
Users who ignore suspicious emails may still fall victim if their AI assistant processes the message. The assistant might summarize the ignored email as a priority task, such as changing vendor payment details. This turns an ignored threat into an actionable item. The AI presents the malicious request as its own recommendation, leveraging the user’s trust in the tool to encourage an employee to send money to an attacker’s account.
The background
Barracuda recently documented emails designed to deceive both humans and AI systems simultaneously. For humans, these emails often feature password-protected attachments with credentials provided in the body. For AI systems, they contain indirect prompt injections. These instructions are concealed using techniques like invisible zero-width characters, encoded content, or HTML comments. This obscures the malicious intent from human eyes while remaining readable by AI models that extract and process email text.
What changes now
Apollo Raines, developer of ShipItClean, noted that the core vulnerability is the model’s inability to distinguish between content to read and instructions to follow. He stated that stripping hidden content before it reaches the model is essential but described the situation as an arms race. Raines emphasized that defenses must exist inside the tools and the models themselves, including sandboxing and human sign-off for payments, because users have not learned to distrust their AI assistants as they do email.
What to do and how to stay safe: Malwarebytes Labs
- Review original email content before acting on any AI-generated recommendation involving financial transactions or sensitive data.
- Limit the permissions granted to AI assistants, preventing them from executing actions without explicit human confirmation.
- Monitor AI tool settings to ensure they do not automatically process or summarize emails containing attachments or links from unknown senders.
- Educate staff that AI summaries are not verified facts and require manual validation against the source message.
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How do attackers hide instructions from humans in phishing emails?
Attackers use techniques such as invisible zero-width characters, encoded content, HTML comments, and text styling that makes text invisible to human eyes but readable by AI systems.
What is an indirect prompt injection?
It is a technique where malicious instructions are planted in external material, such as an email, that an AI system is supposed to read and process, hoping the model will follow the instructions instead of treating them as data.
Does this mean AI email assistants are no longer safe to use?
Malwarebytes Labs states users do not need to abandon AI tools, but must consider what permissions they grant and verify recommendations before acting on them.
