Barracuda reported phishing emails meant to influence both a human recipient and an AI assistant processing the inbox. The rendered email can look like a normal invoice or attachment lure while source text contains a hidden prompt designed to change a summary, urgency label or recommended bank-detail action. HTML comments, CSS-hidden spans, encoded strings…
Inspect the ClaimsCase · DiggingBeagle record
Phishing emails carried hidden instructions for AI assistants
Barracuda described malicious emails that aimed to deceive a person while also inserting instructions into material consumed by an AI email assistant.
Scope
Barracuda Research disclosure updated October 6 and posted at a URL dated October 7, 2026. This is a researcher-attributed family of samples and scenarios, not evidence that all depicted bank changes or hiring actions actually occurred.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI / WITH AI
Basis and provenance
Barracuda researchers report encountering dual-target phishing emails and explain several concealment formats. The public article does not provide a full raw MIME corpus, an independently reproduced assistant execution path or a count of completed attacker-desired financial actions. Observed phishing material is not the same as confirmed downstream loss.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-BARRACUDA-RENDER-EXTRACTION-GAP · CLM-BARRACUDA-DUAL-TARGET · CLM-BARRACUDA-SAMPLE-LIMIT · Barracuda Research: Email attacks target people and AI assistants in the same message
At a glance
Review mail in the exact form supplied to the assistant, not only the form displayed to an employee. Keep body text, decoded blocks and invisible formatting in a lower-trust source envelope; a summarizer may quote or describe instructions found there but must not execute them as policy. For finance and identity changes, require an independent transaction…
Read the implicationsRaw MIME samples and processing-pipeline traces were not available for independent replay. No verified amount of lost money, changed payment details or completed tool actions is established. Different mail renderers and AI extraction libraries may expose or strip the concealed material differently.
Limits and uncertaintyFull account
Barracuda reported phishing emails meant to influence both a human recipient and an AI assistant processing the inbox. The rendered email can look like a normal invoice or attachment lure while source text contains a hidden prompt designed to change a summary, urgency label or recommended bank-detail action. HTML comments, CSS-hidden spans, encoded strings and zero-width characters are possible carriers, but each mail extraction pipeline determines which text is actually passed to the model. The public disclosure does not expose a raw MIME collection or establish that all described examples caused a successful payment or tool action.
Mechanism and trust boundary
- 01
Single email mixes two lures
A conventional attachment or invoice body is accompanied by hidden assistant-targeting directives.
Boundary: external sender to recipient mailbox
- 02
Extraction exposes concealed text
An automated reader processes comments, styling, encoded blocks or invisible characters.
Boundary: rendered email to machine-visible data
- 03
Assistant may promote content into instructions
A generated summary includes an attacker-requested priority or payment change.
Boundary: untrusted email body to assistant output and user trust
- 04
Real action still needs authority
Changing payment details or opening an attachment requires subsequent user or tool action.
Boundary: assistant suggestion to financial or host effect
Claims & evidence
CLM-BARRACUDA-CONCEALMENTThe Barracuda analysis enumerates HTML comments, visually hidden CSS text, Base64-encoded blocks and zero-width Unicode characters as ways attacker instructions may appear to automated text extraction but not a human reader.supported
Basis: reported finding
- supportsBarracuda Research: Email attacks target people and AI assistants in the same messageprimary disclosure
Attack vector 2: Hiding instructions from the human but not the AI assistant, four techniques
CLM-BARRACUDA-DUAL-TARGETBarracuda reports investigating phishing messages that combined conventional human-facing lures with hidden instructions targeting AI-based email summary or triage tools.supported
Basis: reported finding
- supportsBarracuda Research: Email attacks target people and AI assistants in the same messageprimary disclosure
The dual-target email attack and Attack vector 1: Traditional phishing
CLM-BARRACUDA-SAMPLE-LIMITThe public analysis presents examples but does not publish a verified affected-mailbox total, a repeatable raw MIME corpus or an audited count of malicious actions that succeeded.supported
Basis: inference
- supportsBarracuda Research: Email attacks target people and AI assistants in the same messageprimary disclosure
The dual-target email attack and Examples seen by Barracuda in real-world attacks
CLM-BARRACUDA-INVOICE-EXAMPLEBarracuda describes an invoice-email example in which hidden text directed an AI summarizer to add a false priority instruction to change payment details; the article does not establish completed transfer of funds.supported
Basis: reported finding
- supportsBarracuda Research: Email attacks target people and AI assistants in the same messageprimary disclosure
Examples seen by Barracuda in real-world attacks, invoice example paragraphs
CLM-BARRACUDA-RENDER-EXTRACTION-GAPBarracuda distinguishes the visible message in an email client from the content that an AI assistant may receive through extraction. It identifies HTML comments, display-hidden styling, encoded material and invisible Unicode as possible carriers for additional prompt instructions, depending on the processing path.supported
Basis: reported finding
- supportsBarracuda Research: Email attacks target people and AI assistants in the same messageprimary disclosure
Attack vector 2: Hiding instructions from the human but not the AI assistant, sections covering HTML comments, CSS hiding, Base64 and zero-width Unicode
Implications
Review mail in the exact form supplied to the assistant, not only the form displayed to an employee. Keep body text, decoded blocks and invisible formatting in a lower-trust source envelope; a summarizer may quote or describe instructions found there but must not execute them as policy. For finance and identity changes, require an independent transaction confirmation channel. Defenses should test whether the local parser actually preserves each concealment method before assuming every technique reaches the model.
Controls and mitigations
- Compare human-rendered views with the raw and sanitized material passed to summarization models.
- Classify all inbound email content as data, not instructions with authority over the assistant.
- Require human validation from an independent channel before changing account or payment details.
Unknowns and contradictions
- Raw MIME samples and processing-pipeline traces were not available for independent replay.
- No verified amount of lost money, changed payment details or completed tool actions is established.
- Different mail renderers and AI extraction libraries may expose or strip the concealed material differently.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 132