Cases › security breach › LR-2026-0135
Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment
Severity moderate: The injection can touch the data and systems of others, such as vendor payment details and leaked data, with a bounded scope stated.
Earliest source we hold 2026-10-07
Barracuda Research analysed a phishing campaign whose emails target both human recipients and the AI assistants that summarize and process their mail. One layer carries ordinary social engineering, such as a password-protected attachment with the password in the body; a hidden second layer carries prompt injection aimed at the assistant, using HTML comments and invisible CSS text. The injection can make the assistant mark the message legitimate or urgent, or instruct it to send wire requests or leak data. Barracuda disclosed the analysis and recommended layered defences.
Risk grouping: AI attacked
| Who caused it | A person or organisation “Analysis by Barracuda Research shows how attackers are combining tactics to manipulate both human users and their email AI assistants in the same phishing email.” source |
|---|---|
| Intended or not | Intended “In one example, a hidden block of text in an invoice email instructs the summarizing AI model to add a fake priority action changing vendor payment details, and the compromised summary nudges an employee toward wiring money to the attacker.” source |
| Before or after release | After release “This manipulates the user’s AI assistant so that the email summary it presents to the user marks the phishing email as legitimate or urgent — pushing the human to open the email and click on the link.” source |
| The AI's part | Attacked “Attackers now have a second target in their sights: the AI systems that sit between the email and the user.” source |
The story
1 · What it was doingEmail AI assistants were summarizing, prioritizing and processing users' email, with access to inboxes, calendar invites and support tickets, for organizations that rely on them.
2 · What went wrongHidden prompt injection in the email made the assistant present the phishing message as legitimate or urgent, or hijack its response to request wire transfers or leak data, breaching the boundary between email data and instructions.
3 · What it reached or didThe attack reached the user's inbox and the assistant's summary, and could push the user to open a malicious attachment or wire funds to an attacker-controlled account, or leak data.
4 · How it was caughtBarracuda Research uncovered the attacks through its own analysis of a sample dual-target email and real-world examples.
5 · What was doneBarracuda published the analysis and recommended layered defences: input sanitization, prompt injection detection, AI sandboxing, output validation, human approval for sensitive decisions, and monitoring and logging.
What the sources state
- Cause hostile input carried instructions
- What set it off hidden instructions in its input
Show every field, with its source and grade
The AI system
Software around the model
email AI assistant
C one secondary source states it
Tools it was given
email read, email summarize, calendar invites, support tickets
C one secondary source states it
What it was allowed to do
Access to email content and the ability to summarize, prioritize, accept calendar invites and process support tickets on the user's behalf.
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
embedded
D inferred by us from the described behaviour, reason shown
What it was for
To summarize email messages, prioritize inboxes, accept calendar invites, process support tickets, and help make business decisions.
C one secondary source states it
Meant for live use
yes
D inferred by us from the described behaviour, reason shown
What happened
Earliest source we hold
2026-10-07
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Themes
phishing, prompt injection, email assistant, hidden text, social engineering
C one secondary source states it
Cause
hostile input carried instructions
C one secondary source states it
Cause in detail
The hidden layer of the email carries prompt injection instructions that the AI assistant reads and acts on.
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
Hidden text in HTML comments and invisible CSS-styled text inside the phishing email.
C one secondary source states it
What was done
Barracuda recommends input sanitization, prompt injection detection, AI sandboxing, output validation, human approval requirements for sensitive decisions, and monitoring and logging.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
Impact
Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
money, privacy, others' security
C one secondary source states it
Who was affected
Users of email AI assistants and the organizations whose email and payment processes the assistants touch.
C one secondary source states it
Why this severity
The injection can touch the data and systems of others, such as vendor payment details and leaked data, with a bounded scope stated.
D inferred by us from the described behaviour, reason shown
Context
Investigated
by an unpaid independent party
C one secondary source states it
How it was analysed
by people
C one secondary source states it
LR-2026-0135 · version 3 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON