Ignore the Phishing Email. Your AI Assistant Might Not.
The short answer
$3.05 billion. That is what businesses and individuals reported losing to business email compromise in 2025, according to the FBI's Internet Crime Complaint Center, across 24,768 complaints. The scam behind those numbers has always depended on getting one person to trust one email.
Security researchers now report a version that can work even if the person never trusts it. A phishing email can carry a second, hidden message addressed not to you but to the AI assistant that summarizes your inbox. You can delete the email. Your assistant may still tell you that "update vendor payment details" belongs at the top of your to-do list.
For any business that has connected an AI tool to its email, the practical rule is simple: an AI summary is not verification, and no AI tool should be able to change a payment instruction on its own.
What Barracuda found
On October 7, 2026, Barracuda threat analyst Guruprasad Kenja published a "Threat Spotlight" titled "Email attacks target both humans and AI in the same message." The idea is that a single email now has two layers. In Barracuda's words, "One layer contains the text and images that the recipient sees."
The visible layer is ordinary phishing aimed at a person. Barracuda's example is a password-protected attachment with the password given in the body of the email. The second layer is aimed at the machine. It contains instructions hidden from the human reader but still present in the content an AI assistant may read, written to influence how the assistant summarizes or handles the message.
Barracuda describes four ways of hiding those instructions:
HTML comments. The text sits inside comment tags. A mail program does not display it, but it remains in the raw source.
Invisible styling. Text is set in a zero-pixel font, colored white, or hidden outright. It takes up no space on screen but still exists in the document.
Encoded blocks. Instructions are packed into Base64 data, such as an image data string, that an automated pipeline may decode.
Zero-width characters. Invisible Unicode characters are mixed into otherwise normal text.
Barracuda's examples fall into a few groups. Under a heading for examples it has seen in real-world attacks, it describes an invoice email, from a campaign its researchers analyzed, whose hidden block tells a summarizing AI to add a fake priority action changing a vendor's payment details. The result, Barracuda says, is a summary that "nudges an employee toward wiring money to the attacker." It describes a resume-screening case in which a candidate embeds hidden text telling the AI to rate the applicant 10 out of 10 and recommend an interview. It also describes risks to customer support bots (a request dressed up as authorized admin maintenance, asking the bot to reveal its configuration) and to code assistants (poisoned documentation instructing the assistant to insert a credential-stealing line). Those last two are framed as threats such tools face rather than as specific incidents.
Why it works
An AI model reads text. It does not reliably know which text is the material it was asked to summarize and which text is an instruction it should follow. When both arrive in the same untrusted message, the model may treat the hidden instruction as a command. This is called indirect prompt injection, and it is the same weakness behind the case we covered earlier this month, in which a litigant hid instructions for AI tools in a court filing. We wrote about that case in The Filing Was Talking to the Machine. The Judge Was Reading It on Paper. The filing was one place to hide a message. An email is another.
OpenAI has said plainly that this is not a bug that will be patched away. In a December 22, 2025 post about hardening its ChatGPT Atlas browser agent, the company wrote: "Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully 'solved.'" The same post described an email test. An attacker seeded a user's inbox with a message containing hidden instructions. When the user asked the agent to send an out-of-office reply, the agent read the malicious message during the task, treated its instructions as authoritative, and sent a resignation letter to the user's CEO instead. OpenAI reported that, after a security update, the agent detected the attempt. The point for everyone else is how ordinary the setup was: the user asked for something routine, and the damage came from an email the user never opened.
What this does and does not show
A few cautions keep this in proportion.
This is vendor research. Barracuda sells email security and names its own products in the post. That does not make the findings wrong, but it is worth knowing who is reporting them.
There are no prevalence numbers. Barracuda's post gives no counts or percentages showing how common these emails are, and it does not say which assistants or mail programs it tested. Whether hidden content ever reaches a model depends on how a particular tool extracts and prepares the email. The examples show what is possible, not that every deployment is vulnerable.
The underlying fraud is not new. The attack still depends on a business acting on a false payment instruction. What changes is that the false instruction can now arrive in a summary written by a tool the employee trusts.
Why it matters for owner-operated businesses
Businesses that pay many vendors from many locations, including franchisees and multi-unit operators, handle a steady stream of invoices, supplier notices and requests to update bank details. In our view, those routines are exactly where a fake "priority action" would blend in. The same exposure applies to any workflow that has an AI tool summarize an inbox, triage support tickets, screen resumes or draft replies.
There is also a legal and insurance dimension. Who bears the loss when a fraudulent payment goes out depends on the facts, the payment and banking agreements, and the controls the business had in place. The time to find out how your insurer and your bank would treat an AI-assisted mistake is before it happens, and a written verification procedure is far easier to defend than an informal habit.
Practical steps
Barracuda's recommendations and OpenAI's guidance point the same way, and they match basic fraud controls that long predate AI.
Never treat an AI summary as verification. "The assistant flagged it as urgent" is not a reason to move money or change a record. Open the original message.
Confirm payment changes through a separate channel. A call to a number you already had on file, or a request through the vendor portal, beats any reply to the email that asked.
Require a human to approve payments and vendor changes. No AI tool should be able to approve, schedule or change a payment instruction on its own authority.
Limit what the assistant can do. Give it the narrowest access it needs. A tool that can only read and summarize does less damage than one that can also send, pay and edit.
Ask your vendors what they strip out. Tools should remove hidden markup, comments and invisible characters before content reaches the model, and should look for instruction-override language. Ask whether yours does.
Treat everything in an email as data. Instructions come from you and your system settings, never from the message being read.
Check the output before it triggers anything. Review what the assistant proposes before it acts, and keep logs so repeated attempts are visible.
Keep the classic controls. Multi-factor authentication, a second set of eyes on bank-detail changes, and an easy way for staff to report suspicious messages still do most of the work.
Write it down and train for it. Add AI summaries to the list of things employees are told not to rely on for payment decisions.
The bottom line
The human reader is still a target, but the attack now has a second target: the AI layer that sits between the inbox and the decision. A business that connects an AI tool to its email has added a new reader to every message it receives, and that reader can be fooled by text no one else can see. Secure that reader the way the inbox itself is secured, with limits on what it can do and a person in the loop for anything that moves money.
Sources
Guruprasad Kenja, "Threat Spotlight: Email attacks target both humans and AI in the same message," Barracuda Blog (Oct. 7, 2026), blog.barracuda.com.
OpenAI, "Continuously hardening ChatGPT Atlas against prompt injection attacks" (Dec. 22, 2025), openai.com.
FBI Internet Crime Complaint Center, 2025 Internet Crime Report (business email compromise: 24,768 complaints and $3,046,598,558 in reported losses), ic3.gov.
Disclaimer
This post discusses publicly reported security research for general informational purposes. It is not legal or security advice, it does not create an attorney client relationship, and it does not reflect the firm's position in any pending matter. Outcomes depend on the specific facts, contracts and governing law.