Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox Assistant

AI assistants that summarize and prioritize email; Barracuda also describes variants against resume screeners, support bots, and coding assistants

Barracuda documented an in-the-wild email that posed as internal mail (same sender and recipient, sent from a public-sector domain, trusted spam score) and paired a password-protected attachment for the human with hidden instructions for the AI. The instructions were concealed in HTML comments, CSS-invisible text, Base64, and zero-width characters, and aimed to make the summary present the message as legitimate and urgent, including requests to change vendor payment details. No volume figures were given

Assistants ingest unrendered email content as instructions, and their summaries feed decisions such as payments without a check against the original