{"schema_version":"0.8.0","id":"LR-2026-0135","record_version":3,"title":"Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-07","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"email AI assistant","tools_granted":["email_read","email_summarize","calendar_invites","support_tickets"],"permissions_scope":"Access to email content and the ability to summarize, prioritize, accept calendar invites and process support tickets on the user's behalf.","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":"embedded","intended_use":"To summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions.","safeguard_state":"unknown","production_intended":true},"event":{"date_occurred":null,"date_disclosed":"2026-10-07","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"Barracuda Research analysed a phishing campaign whose emails target both human recipients and the AI assistants that summarize and process their mail. One layer carries ordinary social engineering, such as a password-protected attachment with the password in the body; a hidden second layer carries prompt injection aimed at the assistant, using HTML comments and invisible CSS text. The injection can make the assistant mark the message legitimate or urgent, or instruct it to send wire requests or leak data. Barracuda disclosed the analysis and recommended layered defences.","tags":["phishing","prompt-injection","email-assistant","hidden-text","social-engineering"],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"The hidden layer of the email carries prompt injection instructions that the AI assistant reads and acts on.","failure_class_detail":"The hidden layer of the email carries prompt injection instructions that the AI assistant reads and acts on.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"Hidden text in HTML comments and invisible CSS-styled text inside the phishing email.","time_to_contain":null,"operations_paused":null,"remediation":"Barracuda recommends input sanitization, prompt injection detection, AI sandboxing, output validation, human approval requirements for sensitive decisions, and monitoring and logging.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate, because data or systems of others touched, with a bounded scope stated: The injection can touch the data and systems of others, such as vendor payment details and leaked data, with a bounded scope stated.","harm_class":["financial","privacy","third_party_security"],"affected_description":"Users of email AI assistants and the organizations whose email and payment processes the assistants touch.","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://blog.barracuda.com/2026/10/07/email-attacks-target-both-humans-ai-assistants","publisher":"news search (Google News index)","date":"2026-10-07","type":"press","title":"Email attacks target both humans and AI in the same message | Barracuda","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.permissions_scope":"C","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"C","system.safeguard_state":"D","system.production_intended":"D","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.failure_class":"C","event.tags":"C","event.root_cause":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"C","event.summary":"C","event.incident_class":"C","event.date_disclosed":"A","impact.harm_class":"C","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.incident_evidence":"C","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"C","event.failure_class_detail":"C","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.harness":[{"source_index":0,"quote":"Analysis by Barracuda Research shows how attackers are combining tactics to manipulate both human users and their email AI assistants in the same phishing email."}],"system.tools_granted":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.permissions_scope":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.autonomy_level":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.deployment_context":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.lifecycle_stage":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.integration_type":[{"source_index":0,"quote":"Attackers now have a second target in their sights: the AI systems that sit between the email and the user."}],"system.intended_use":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"system.safeguard_state":[{"source_index":0,"quote":"No single security control will stop every variation of these attacks."}],"system.production_intended":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"event.failure_class":[{"source_index":0,"quote":"Another layer carries hidden malicious instructions known as prompt injection."}],"event.trigger":[{"source_index":0,"quote":"Another layer carries hidden malicious instructions known as prompt injection."}],"event.detection_method":[{"source_index":0,"quote":"Barracuda Research has uncovered phishing attacks aimed at both human recipients and the AI-powered systems they use to summarize, prioritize, and process email."}],"event.summary":[{"source_index":0,"quote":"Barracuda Research has uncovered phishing attacks aimed at both human recipients and the AI-powered systems they use to summarize, prioritize, and process email."},{"source_index":0,"quote":"Analysis by Barracuda Research shows how attackers are combining tactics to manipulate both human users and their email AI assistants in the same phishing email."},{"source_index":0,"quote":"Another layer carries hidden malicious instructions known as prompt injection."}],"event.tags":[{"source_index":0,"quote":"Analysis by Barracuda Research shows how attackers are combining tactics to manipulate both human users and their email AI assistants in the same phishing email."},{"source_index":0,"quote":"Another layer carries hidden malicious instructions known as prompt injection."},{"source_index":0,"quote":"1. Hidden text in HTML comments. Instructions are tucked inside comment tags that never render in a mail client but remain in the raw source code an AI parses."}],"event.root_cause":[{"source_index":0,"quote":"Another layer carries hidden malicious instructions known as prompt injection."}],"event.root_cause_detail":[{"source_index":0,"quote":"1. Hidden text in HTML comments. Instructions are tucked inside comment tags that never render in a mail client but remain in the raw source code an AI parses."}],"event.adversarial_actor":[{"source_index":0,"quote":"Analysis by Barracuda Research shows how attackers are combining tactics to manipulate both human users and their email AI assistants in the same phishing email."}],"event.input_provenance":[{"source_index":0,"quote":"1. Hidden text in HTML comments. Instructions are tucked inside comment tags that never render in a mail client but remain in the raw source code an AI parses."},{"source_index":0,"quote":"2. Invisible text techniques (CSS). Text is styled with a zero-pixel font size, white color, or hidden completely, so it occupies no visible space yet still exists in the document the model reads."}],"event.remediation":[{"source_index":0,"quote":"- Input sanitization to identify and remove hidden elements, comments, and invisible characters before content reaches AI systems."}],"event.incident_class":[{"source_index":0,"quote":"This manipulates the user’s AI assistant so that the email summary it presents to the user marks the phishing email as legitimate or urgent — pushing the human to open the email and click on the link."}],"event.agent_involved":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"event.failure_class_detail":[{"source_index":0,"quote":"This manipulates the user’s AI assistant so that the email summary it presents to the user marks the phishing email as legitimate or urgent — pushing the human to open the email and click on the link."}],"impact.harm_class":[{"source_index":0,"quote":"In addition to the user manipulation example above, malicious prompt injection can hijack the assistant’s response and instruct the email to ignore its previous directions and instead send an urgent request to wire funds to a specified account, leak data, or surface a fake urgent action."}],"impact.affected_description":[{"source_index":0,"quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing."}],"impact.severity_because":[{"source_index":0,"quote":"In one example, a hidden block of text in an invoice email instructs the summarizing AI model to add a fake priority action changing vendor payment details, and the compromised summary nudges an employee toward wiring money to the attacker."}],"context.industry":[{"source_index":0,"quote":"The ‘From’ and ‘To’ addresses match the same mailbox, the message carries a trusted spam confidence score, and it originates from a public sector domain, all of which lend it perceived legitimacy and help it pass reputation-based filtering."}],"context.country":[{"source_index":0,"quote":"The ‘From’ and ‘To’ addresses match the same mailbox, the message carries a trusted spam confidence score, and it originates from a public sector domain, all of which lend it perceived legitimacy and help it pass reputation-based filtering."}],"context.incident_evidence":[{"source_index":0,"quote":"A recent attack campaign analyzed by Barracuda researchers demonstrates how such attacks combine traditional social engineering with malicious prompt injection."}],"impact.severity":[{"source_index":0,"quote":"In one example, a hidden block of text in an invoice email instructs the summarizing AI model to add a fake priority action changing vendor payment details, and the compromised summary nudges an employee toward wiring money to the attacker."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-07"}]},"notes_on_gaps":"No source states the model name or version, the developer, the operator, the autonomy arrangement, the date the failure occurred, the date it was detected, the duration, the time to contain, the number of third parties affected, any dollar loss figure, records exposed, remediation hours, downstream exposure count, org size band, or a denominator. event.date_disclosed is derived by rule and not written. system.tier is derived by rule and not written. event.duration, event.time_to_contain and event.date_detected are not written in fields; no dated timeline items exist to bound them. The trigger is prompt_injection as stated by the source; no source rules out an external cause, so spontaneous is not used. The root cause is adversarial_input because the source states untrusted email content carried the hidden instructions; no source states a control that existed and failed, so guardrail is not used and the absence of controls is recorded here rather than as a root cause. The severity tier is moderate because the source states the injection can touch vendor payment details and leak data with a bounded scope; no source states a loss figure, so the dollar bands do not apply. context.coverage is a Lossrate judgement, grade D. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-11] system.lifecycle_stage: production. system.integration_type: embedded. system.safeguard_state: classified from described behaviour. system.production_intended: classified from described behaviour. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: production. event.responsible_party: third_party. context.industry: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.coverage: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":"unknown","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":null,"tamper_evidence":null,"timestamp_reliability":"unknown","investigation_independence":"unpaid_independent","redaction_summary":null,"analysis_method":"human_review","prompt_output_retention":null},"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Email AI assistants were summarizing, prioritizing and processing users' email, with access to inboxes, calendar invites and support tickets, for organizations that rely on them.","quote":"As users increasingly rely on AI assistants to summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions, the phishing attack model is changing.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Hidden prompt injection in the email made the assistant present the phishing message as legitimate or urgent, or hijack its response to request wire transfers or leak data, breaching the boundary between email data and instructions.","quote":"This manipulates the user’s AI assistant so that the email summary it presents to the user marks the phishing email as legitimate or urgent — pushing the human to open the email and click on the link.","source_index":0,"grade":"C"},{"step":"reached","text":"The attack reached the user's inbox and the assistant's summary, and could push the user to open a malicious attachment or wire funds to an attacker-controlled account, or leak data.","quote":"In addition to the user manipulation example above, malicious prompt injection can hijack the assistant’s response and instruct the email to ignore its previous directions and instead send an urgent request to wire funds to a specified account, leak data, or surface a fake urgent action.","source_index":0,"grade":"C"},{"step":"caught","text":"Barracuda Research uncovered the attacks through its own analysis of a sample dual-target email and real-world examples.","quote":"Barracuda Research has uncovered phishing attacks aimed at both human recipients and the AI-powered systems they use to summarize, prioritize, and process email.","source_index":0,"grade":"C"},{"step":"done","text":"Barracuda published the analysis and recommended layered defences: input sanitization, prompt injection detection, AI sandboxing, output validation, human approval for sensitive decisions, and monitoring and logging.","quote":"- Input sanitization to identify and remove hidden elements, comments, and invisible characters before content reaches AI systems.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-11","source_urls":["https://blog.barracuda.com/2026/10/07/email-attacks-target-both-humans-ai-assistants"]}}