A phishing email now has two readers in mind. One is the person whose inbox it lands in. The other is the AI assistant that person asks to summarise the day's mail, and attackers have started writing separate, invisible instructions for it.
Guruprasad Kenja, a threat analyst at Barracuda, described the technique in a threat spotlight published this month. The email he examined carries a visible layer aimed at the human and a hidden layer of prompt injection aimed at the machine. Prompt injection means planting instructions in content an AI system is supposed to read, in the hope that it obeys them instead of treating them as text. Here, the goal is to make the assistant's summary describe the phishing message as legitimate or urgent, which nudges the user back towards a message they may have already decided to ignore.
A lure built to slip past filters first
The human layer is conventional but carefully tuned. According to Barracuda, the From and To addresses point to the same mailbox, the message comes from a public sector domain with a trusted spam confidence score, and it reads like routine internal correspondence about a business process. The payload is a password-protected document with the password supplied in the body, which Barracuda calls a blind spot for traditional email security controls because the gateway cannot inspect what it cannot open.
Four ways to hide a sentence from people
Barracuda lists the concealment tricks it sees: instructions inside HTML comments, which never render in a mail client but remain in the source an AI parses; text made invisible with CSS, such as a zero-pixel font or white-on-white colouring; instructions buried in Base64-encoded data such as an image string; and zero-width Unicode characters mixed into normal text. Microsoft researchers recently documented a related invisible-character trick used to slip phishing past filters, which we covered in September.
The examples Barracuda gives show where this goes beyond flattering summaries. In one, hidden text in an invoice tells the summarising AI to add a fake priority action to change a vendor's payment details, steering an employee towards wiring money to the attacker. Others target a CV-screening tool told to rate a candidate 10 out of 10, a customer support bot asked to reveal its configuration under a fake maintenance mode, and a coding assistant fed poisoned documentation telling it to insert a credential-stealing line into authentication code. Barracuda did not publish figures on how widespread the technique is.
In a write-up of the research, Malwarebytes notes that whether hidden content actually reaches the model depends on how each tool extracts the email, which is why the fix cannot rest on users looking harder. The broader class of risk is not new; EchoLeak showed in 2025 how a single crafted email could manipulate Microsoft 365 Copilot.
Strip hidden content and keep humans on payments
Barracuda recommends sanitising input so that comments, hidden elements and invisible characters are removed before content reaches an AI system, detecting instruction-override language, sandboxing assistants so they can reach only what they need, validating AI output before it triggers any action, and logging injection attempts. Its core principle is that external content should be treated as data only and kept separate from instructions.
For users, the rule is simpler. A summary is not verification. If an assistant recommends paying an invoice, changing bank details or sharing sensitive data, go back to the original message and confirm through a channel you already trust. Organisations should require human approval for payments and vendor changes, whatever the assistant says. The email filter is no longer the only reader an attacker needs to fool.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.