Phishing emails that target your AI inbox assistant
Hidden text in an email can steer an AI assistant that reads it. Five checks for an app you built, each ending as detected, unknown or confirmed by owner evidence.
Founder, Newly
Published Last updated
Attackers can hide instructions in an email, in HTML comments, invisible styling, encoded text or zero-width characters, so that an AI assistant reading the message may follow them while the person sees nothing. If your app summarizes or acts on email, limit what the assistant may do, label email as untrusted, and require a human tap before anything is sent.
What did researchers report about emails aimed at AI assistants?
Barracuda's threat spotlight, dated October 6, 2026, describes emails written for two readers at once: the person, and any AI assistant that processes the message. Malwarebytes summarized it on October 12. At our check on October 24, 2026, neither post gives a count of how often this happens. Read it as a documented technique with no published rate.
| Question | What the source says | Source and date |
|---|---|---|
| How is the text hidden? | HTML comments, invisible text through CSS, Base64-encoded data and zero-width characters | Barracuda, October 6, 2026 |
| What did the hidden text try to achieve? | Changing vendor payment details, making a suspicious email look routine or urgent, advancing an unqualified job candidate, getting a support bot to reveal its configuration, and, through poisoned web documentation rather than email, getting a coding assistant to add a credential-exfiltration line | Barracuda, October 6, 2026 (payment and routine-or-urgent goals also in Malwarebytes, October 12, 2026) |
| Has it been given a technique ID? | Yes. ATT&CK v20 added T1698 Indirect Prompt Injection and T1699 Direct Prompt Injection | MITRE ATT&CK, October 13, 2026 |
| Can it be fully fixed? | The NCSC says it will not be mitigated the way SQL injection was, and the best available is reducing likelihood or impact | UK NCSC, December 8, 2025 |
Anthropic's docs call this indirect prompt injection: the user is trusted, and the model reads third-party content, such as an inbound email, that carries adversarial instructions.
Does this apply to my app if I did not build an inbox tool?
It applies to any feature that feeds text written by someone else to a model: email, support messages, form submissions, reviews, uploaded documents. If your app summarizes a message, suggests a reply, sorts mail or calls other functions based on what a message says, the sender is one of the writers of your prompt.
Newly builds a real iPhone and Android app with React Native and Expo, and you can download the code or connect your own repository, so you can open the project and read what the AI feature is allowed to call. AI inside your app uses credits, so a feature that reads every incoming message spends them on every message, including the ones an attacker sends.
You cannot reliably clean the left side of that picture. Make the model's output a suggestion, and let a person and a narrow permission decide.
What can the assistant do, and what does an injection gain from that?
The damage depends on the permissions and tools you hand the model. OWASP calls the underlying problem Excessive Agency: too much functionality, too many permissions, or too little human approval. Its listed fixes are human approval for high-impact actions, least privilege, and authorization in the systems the model calls rather than in the model.
| Feature | Permission to look for | What steering could gain | Control |
|---|---|---|---|
| Summarize | gmail.readonly, Graph Mail.Read | A summary that calls a phishing email routine | Show sender and a link to the original beside the summary |
| Draft and send | gmail.send, Graph Mail.Send | A message sent from the user's address | Draft only. The person taps send |
| Search and forward | gmail.modify, Graph Mail.ReadWrite | Mail contents sent to an outside address | No forward tool, or a fixed recipient list |
| Clean up | https://mail.google.com/ | Permanent deletion of mail | Do not request the full-access scope |
| Call your backend | A database service key | Other users' rows | Pass the user's own token so row rules apply |
Google's scope reference lists gmail.readonly, gmail.modify and the full mail.google.com scope as restricted and gmail.send as sensitive, as of October 24, 2026. Microsoft Graph keeps Mail.Read and Mail.Send as separate permissions. Supabase's row level security docs say the service role key bypasses RLS when used without a user token, which is why the last row matters.
What should I check in my own app?
Five checks, about ten minutes each. Write down what you find. The self-test below turns the notes into detected, unknown or confirmed.
1. Which mail scope does the app request?
Open your Google Cloud or Microsoft app registration and list the scopes. A summary feature needs a read scope only. If you see send, modify or full access, find the feature that needs it. If none does, remove it and reconnect.
2. Which tools does the model receive?
Find the list of functions your code passes to the model. Mark every one that writes, sends or deletes. OpenAI's guidance for building agents says that with MCP tools you should enable tool approvals so people can review each operation, reads and writes included. Move every marked tool behind a confirm screen.
3. Where does the email text enter the prompt?
Search the code for the line that adds the message body. It should not land in the system prompt or a developer message, where OpenAI notes untrusted text gets the most influence. Anthropic's docs say to deliver third-party content in tool results, say in the system prompt that it is untrusted data, and JSON-encode it. Microsoft's three layers are prevention, detection and impact mitigation, with a person approving sensitive actions.
4. Does your own test mail get obeyed?
Use a test mailbox you own. Send four emails, one per hiding method Barracuda names: an HTML comment, invisible CSS text, encoded text and zero-width characters. In the hidden part, ask for something harmless and visible, such as a changed word in the summary. If the assistant changes the summary, mark it detected. If it reports the hidden line or ignores it, record the date and the output as evidence. Anthropic's docs recommend red-teaming your own agent this way before you deploy.
5. Where does the AI provider key live?
Expo's environment variable docs say variables starting EXPO_PUBLIC_ are visible in plain text in the compiled app. The model key belongs in a server secret, such as a Supabase Edge Function secret. If a key ever shipped, rotate it using the rotate secrets guide. Bots probing for exposed files are covered in a 30-second check. Add a per-user message cap so a stranger cannot drain your credits.
What a scan can and cannot see
The red.run.cloud free scan reads the stack your website serves, checks shipped bundles for API keys and tokens, and looks for exposed .env and .git files. It does not read your mail or call your assistant, so it cannot tell you whether hidden text gets obeyed. Check 4 stays yours.
What do filters and prompt wording not fix?
Stripping comments, invisible styling, encoded blocks and zero-width characters removes the four methods Barracuda named. Instructions written in ordinary visible words pass through that filter. The NCSC advises deterministic limits on what the system can do, and notes that when a model processes text from a party, its privileges drop to that party's. OWASP's 2026 list was announced on September 1, 2026.
| If your app | Minimum controls |
|---|---|
| Summarizes mail | Read scope, original linked, untrusted label, message cap |
| Drafts replies | All of the above, and the person edits and sends |
| Sends, files or deletes on its own | A confirm screen for each action, a fixed recipient list, a log of every call |
Malwarebytes advises confirming any payment change through a channel other than the email and the assistant. Put that sentence on the screen where the assistant mentions a payment.
Where do you stand?
Everything starts as unknown. Move an item to confirmed only when you hold the evidence listed under it. Nothing here proves your assistant cannot be steered, and no scan can move an item for you.
Your inbox assistant check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Can an email really give instructions to an AI assistant?
Yes, when the assistant reads the message text. A language model does not reliably separate your instructions from the words it is summarizing, so text hidden in an email can be read as a command. Barracuda reported emails built this way in October 2026. The risk grows with what the assistant is allowed to do.
Will stripping hidden text from emails solve it?
It helps with the four hiding methods Barracuda named, and it is worth doing. It does not cover instructions written in plain, visible text. The UK NCSC says prompt injection is unlikely ever to be fully mitigated, so also limit what a fooled assistant could reach.
My app only summarizes email. Is there still a risk?
Yes. A summary can be bent to call a suspicious message routine or urgent, which is one of the goals Malwarebytes described. Show the sender and a link to the original beside every summary, and tell users to confirm money or credential changes through a separate channel.
Which mail permission should my app ask for?
The narrowest one that does the job. For Gmail that usually means gmail.readonly for a summary feature, and no send or full-access scope unless a person confirms each send. Microsoft Graph separates Mail.Read from Mail.Send in the same way.
Does a red.run.cloud scan test my inbox assistant?
No. Both scans work from outside against a live website, so an assistant that reads private mail is outside what they can see. They can show keys shipped in a bundle and exposed .env or .git files, which matter if the assistant's provider key lives in the app.
Does AI inside a Newly app use credits when it reads email?
AI inside your app uses credits, so a feature that processes every incoming message spends them with each one. Some features have limits. Cap messages per user and per day, and check the limit before you publish.
Sources
Pages opened and read on October 24, 2026.
- Threat Spotlight: Email attacks target both humans and AI in the same message (October 6, 2026), Barracuda Networks
- Phishing emails are baiting your AI assistant (October 12, 2026), Malwarebytes
- ATT&CK v20 updates, October 2026 (T1698, T1699, T1700), MITRE ATT&CK
- Prompt injection is not SQL injection (it may be worse), UK National Cyber Security Centre
- Mitigate jailbreaks and prompt injections, Anthropic, Claude API docs
- Safety in building agents, OpenAI, API docs
- How Microsoft defends against indirect prompt injection attacks (July 29, 2025), Microsoft Security Response Center
- LLM06:2025 Excessive Agency, OWASP GenAI Security Project
- OWASP GenAI Security Project unveils 2026 Top 10 for LLM Applications (September 1, 2026), OWASP GenAI Security Project
- Gmail API: choose authorization scopes, Google for Developers
- Microsoft Graph permissions reference, Microsoft Learn
- Environment variables in Expo, Expo docs
- Edge Functions secrets, Supabase docs
- Row Level Security, Supabase docs