Phishing emails now write to your AI assistant. Let it read, not act.

On October 7, 2026, Barracuda Research published a Threat Spotlight on phishing emails that try to fool two readers at once: the person who owns the inbox, and the AI assistant that summarizes it. If you use AI to sort, summarize or act on email, this is the attack written for you. This post covers what Barracuda found and the few settings worth changing this week.

What Barracuda found

Barracuda describes a phishing campaign whose emails carry two layers.

1. 01

   The layer you see.

   A routine-looking message, in Barracuda's sample sent from and to the same mailbox, with a password-protected attachment and the password helpfully included. Open it, and the attack moves on to stealing credentials or installing malware.

2. 02

   The layer you don't see.

   Hidden instructions aimed at the AI assistant. If you ignore the email, the attacker hopes your assistant will summarize it as legitimate or urgent, so you go back and open it.

Barracuda says four hiding places come up often:

1. 01

   HTML comments

   that never show in your mail app but sit in the code an AI reads.

2. 02

   Invisible text,

   styled with a zero-size font or white-on-white.

3. 03

   Base64-encoded blocks,

   such as an image data string that decodes to text.

4. 04

   Zero-width characters,

   invisible Unicode mixed into normal text.

The examples worth knowing

Barracuda shared examples it saw in real attacks:

1. 01

   An invoice email

   with a hidden block telling the summarizing AI to add a fake priority action changing a vendor's payment details. The summary nudges an employee toward wiring money to the attacker.

2. 02

   A job application

   with hidden text telling an AI screener to rate the candidate 10 out of 10 and recommend an immediate interview.

3. 03

   A support chatbot

   asked, in a fake "admin mode," to reveal its own configuration.

4. 04

   A coding assistant

   reading a poisoned web page that tells it to slip a credential-stealing line into the code it writes.

"The most dangerous aspect of this emerging threat is how ordinary it looks," Barracuda wrote.

Why it matters to a small business

Most small businesses won't run a security team, but many already let AI read their email. Inbox summaries, smart replies, assistants that create tasks or accept calendar invites: each one reads every word in a message, including the words you can't see.

That changes one old rule. "Don't click suspicious links" used to cover most of it. Now the risky moment can be reading a tidy summary that says "urgent: vendor bank details changed" and acting on it without opening the original.

Whether hidden text actually reaches the model depends on how each tool reads the email, as Malwarebytes noted in its coverage. You don't need to know which tools are exposed to protect yourself. You need a few rules that hold either way.

Three rules to set first

These are our suggestions, not Barracuda's product advice.

1. 01

   1. Summaries never move money.

   Any summary that mentions a payment, an invoice, a bank change or a gift card sends someone back to the original email, and then to a phone call on a number you already have.

2. 02

   2. The assistant reads and drafts. A person sends, pays and accepts.

   Check your AI tool's settings. If it can send replies, accept invites, create payment tasks or forward messages on its own, turn those off or require approval.

3. 03

   3. Hiring and support get a human check.

   If AI screens resumes, a person looks at every shortlist and a sample of rejections. If you run a website chatbot, keep passwords, discount codes and internal notes out of its instructions.

Barracuda's own list of defenses points the same way: remove hidden content before AI reads it, detect injected instructions, limit what assistants can access, check AI output before it triggers an action, and require human approval for financial transactions and vendor changes. "No single security control will stop every variation of these attacks," Barracuda wrote.

This week

1. 01

   List every AI tool that reads your email,

   including built-in summaries in your mail app and any assistant you connected.

2. 02

   Check what each one can do on its own:

   read, draft, send, accept invites, create tasks. Switch anything that acts into "suggest only."

3. 03

   Tell your team the money rule

   in one sentence: no payment or bank change based on a summary.

4. 04

   Ask your email provider or IT contact

   whether hidden text and invisible characters are stripped before AI tools read messages.

5. 05

   Re-check vendor bank details

   on any change requested in the last 30 days, by phone.

Our take

An AI assistant reads everything, including what the sender hid from you. Let it read and summarize; keep payments, vendor changes and anything that leaves the business with a person.

No partnership with Barracuda is implied here.

Sources

Threat Spotlight: Email attacks target both humans and AI in the same message (Barracuda, Guruprasad Kenja, Oct 7, 2026)

Phishing emails are baiting your AI assistant (Malwarebytes, Pieter Arntz, Oct 12, 2026)