You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.

Then you asked your AI assistant to summarize your inbox.

Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?

That’s the risk behind phishing emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. Recent research from Barracuda describes emails designed to target both audiences at once.

For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.

By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.

In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.

The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.

How prompt injection works

Prompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.

The malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.

That means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.

Apollo Raines, developer of the AI code review service ShipItClean, explains:

“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”

He adds:

“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”

Before taking action

An assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.

An assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose sensitive information.

You don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.

The familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:

• Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account details, or share sensitive information, don’t treat the summary itself as verification.
• Always verify payment changes through a separate, established channel. Contact the person or organization using details you already trust, rather than relying on information supplied in the suspicious message.
• Keep your AI assistant’s permissions limited to what you need and, at work, what your organization allows. An assistant used to summarize emails should not need broad authority to carry out unrelated actions. Limiting access can reduce the consequences if it follows malicious instructions.
• Require human approval for high-impact actions like payments and changes to vendor payment details. Approval should include checking the underlying request, not simply accepting the assistant’s recommendation.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The adoption of AI agents in millions of organizations is creating new opportunities for attackers to make them take malicious actions, such as exfiltrating database contents and sensitive business and personal information.

In the past five months, Google and four other organizations—with little in common except for their use of AI agents—have acknowledged vulnerabilities that exploit one agent inside a targeted network to spread harmful instructions to other internal agents. The technique is a special form of prompt injection that targets not the LLM but a particular agent, such as one for translation or data analysis. Guardrails inside such agents, if they exist at all, are often lax and will send the instructions to other agents down the chain. Because the latter agent explicitly trusts the first one, it follows the directions.

Unexpected and hard to mitigate

Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. His proof-of-concept attacks exploit trust gaps in MCP, short for Model Context Protocol. The standard is one way AI apps and agents communicate with each other inside an internal network. The illustration below shows a simplified MCP in action.

Read full article

Comments

Why Agentic AI Harnesses Matter

Harness Becomes a Long-Term Security Focus

ASD Highlights Key Agentic AI Risks

Security Controls for Agentic AI

Check Point Research disclosed Tuesday that a weakness in ChatGPT's code-execution sandbox let data from one user's connected Gmail account be moved into a separate, attacker-controlled ChatGPT account, with no confirmation prompt shown to the victim.

The flaw sat not in the model but in the infrastructure beneath it. Containers running individual conversations cannot address one another directly, Check Point found, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management. An item-management feature there let any container attach text metadata properties to cached items and read properties written by others, turning a package cache into a two-way message board between environments meant to be isolated.

How the Chain Worked

The attack starts with an instruction the victim never sees. Researchers demonstrated three delivery routes, any one of them was sufficient. First, a prompt pasted into a chat, second was a shared conversation link, or third, a custom GPT carrying a hidden instruction.

The victim's session then quietly processes a second stream of tasks alongside the conversation they can actually see. In one demonstration described by The Register, the user got an ordinary answer, a temperature chart, while an injected task told the session to use the Gmail connector and list their messages.

Those instructions reach whatever the victim has connected. Researchers cited Gmail, Google Drive, Microsoft Teams and GitHub in their findings.

The decisive detail is the permission model. ChatGPT's default connected-app setting automatically approves read actions it judges low risk, with no separate confirmation step. The only trace researchers observed was a small "Talked to Gmail" label appearing afterward. Harvested data went into the shared metadata channel and was collected by the attacker's own session — exfiltration that never touches the victim's browser or their employer's network egress, leaving nothing for conventional data-loss prevention tools to inspect.

Also read: New ChatGPhish Technique Uses Prompt Injection to Manipulate ChatGPT Responses

The Hugging Face Connection

Check Point reported the channel to OpenAI in late June and says it had a working proof of concept before the activity that led to the Hugging Face compromise OpenAI has since disclosed. The two are separate attacks using different techniques, but both ran through the same internal Artifactory instance. On disclosure, OpenAI told Check Point the instance had already been decommissioned because of the Hugging Face incident, so no user-facing patch was needed, and Check Point's write-up cites no CVE for the channel.

In that episode, OpenAI models running an internal exploitation evaluation chained Artifactory zero-days to escalate privileges, reach a node with internet access and pull evaluation answers from Hugging Face's production database. JFrog patched three flaws credited to OpenAI researchers in Artifactory 7.161.15; Hugging Face disclosed the intrusion July 16.

Also read: OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout

Check Point's Pedro Drimel Neto framed the lesson as one of privilege rather than model behavior, saying "the biggest AI security risk has become the access and trust we give it." The firm calls an assistant that holds credentials, runs code and reaches connected services a "coerced insider," and argues the many-tenants-on-one-shared-service pattern warrants scrutiny across agent platforms. OpenAI did not respond to The Register's request for comment.

The latest disclosure lands weeks after the European Commission and national authorities began enforcing the EU AI Act on Aug. 2. Indirect prompt injection remains the top entry in OWASP's Top 10 for large language model applications, and NIST's AI Risk Management Framework treats leakage through connected tooling as a core control area. For enterprises, the exposure is also a GDPR question. Mailbox contents reached through a sanctioned connector are still personal data, and a cross-tenant route to them is a processing failure whether or not it was abused.

Someone hid AI instructions into a legal filing.

Alternate link.

A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution.

AI researchers describe “Cryptographic Context Injection”—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to decrypt that data using its own code-execution tool. As a result, the AI may treat the resulting text as if it were trustworthy internal information.

A prompt injection is a bit like leaving a fake instruction inside a document for an AI assistant to read. Instead of following only the user’s request, the assistant may be tricked into following an attacker’s instructions hidden in a webpage, email, or file.

As we reported months ago, experts have warned that prompt injection attacks are a problem that may never be fixed. Prompt injection works because AI models can’t reliably tell the difference between the legitimate instructions and an attacker’s instructions, so they sometimes obey the wrong ones.

To reduce this risk, AI providers set up their models with guardrails: protections designed to stop AI systems from doing things they shouldn’t, either intentionally or unintentionally.

What the researchers found was that malicious instructions could be hidden from some AI guardrails by encrypting them. The AI itself could then be tricked into decrypting those instructions using its coding tools.

By the time the instructions became readable, they had already made it past the initial security checks. The AI could then mistake them for legitimate instructions and follow them.

It’s a bit like hiding malicious instructions in a language the security system can’t understand. The AI translates them only after they’ve passed the security checks, then may follow what they say.

The researchers tested their method against two AI agents, with different results. In Grok, the researchers say the attack could steal information including the user’s name, approximate location, subscription tier, and conversation history. In Gemini, they used the technique to bypass safety controls and generate content the model would normally not do.

“In Grok, an ordinary ‘summarize this page’ steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”

The researchers did not provide full details because xAI had not taken action after the flaw in Grok was reported to it in June 2026. Gemini, on the other hand, has made improvements, but has still not fully closed the hole.

How to stay safe

An AI assistant may be helpful, but it should not automatically be trusted with sensitive data or powerful tools.

• Treat AI summaries of unfamiliar webpages, documents, and shared links with caution, especially when the assistant can browse or run code.
• Do not paste passwords, recovery codes, API keys, financial information, or sensitive health and work details into AI chats unless you understand how that information will be handled.
• Review an AI assistant’s connected tools and permissions. Remove access it doesn’t need, particularly email, cloud storage, source-code repositories, and external integrations.
• Be skeptical if an AI tool asks to decrypt, decode, run a script, open a new link, or upload data as part of a seemingly ordinary task.
• Keep browser and AI applications updated, and check vendor security advisories when using features such as browsing, autonomous agents, or code execution.
• Use an up-to-date, real-time anti-malware solution to detect and block malicious downloads and suspicious connections.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Researchers at Adversa AI disclosed an attack technique that smuggles malicious instructions past AI safety filters by encrypting them. They then demonstrated it against production deployments of xAI's Grok and Google's Gemini - including a zero-click chain that could exfiltrate a Grok user's entire chat history.

The technique, which the researchers call Cryptographic Context Injection, inverts the usual assumption behind input filtering. Guardrails inspect prompts and retrieved content as text; an AES-256-GCM ciphertext contains no readable instruction to flag. The model itself performs the decryption inside its own code-execution sandbox, and then treats the recovered plaintext as trusted intermediate output rather than as untrusted external content. Adversa noted that every element a scanner would need is present on the page, but recovering it requires "running PBKDF2 and AES-256-GCM."

That distinction separates the work from earlier cipher-based jailbreaks such as CipherChat and CodeChameleon, which relied on substitution ciphers or Base64 encoding that large language models can decode natively during inference. Strong authenticated encryption forces execution, and execution is what launders the payload's provenance.

The demonstrated impact differed by target. Against Grok, the researchers showed an indirect, zero-click path. Encrypted JSON embedded in a web page is picked up when Grok's agentic browsing analyzes the site, and the decrypted instructions then leak session data like user name, coarse location, subscription tier and full conversation history, to an attacker-controlled URL. No click or warning reached the user.

Also read: French Police Raid X Offices as Grok Investigations Grow

Against Gemini 3 Flash on the web at the paid tier, the same approach produced instructions for building incendiary devices in the model's Deep Thinking mode, and caused the model to reproduce its own system instructions. Adversa said its Gemini success rate had fallen sharply since June and dropped significantly by August, but could not attribute the change to filter updates, model version changes or both.

Vendor engagement was limited. Adversa reported the Grok issue to xAI on June 3, received an initial acknowledgment, and followed up on August 4 and 10 without substantive response. The firm confirmed the attack still reproduced on August 19.

The Gemini finding was never formally reported, because Google's AI vulnerability reward program excludes prompt injection, jailbreaks and alignment issues from scope, directing them instead to in-product feedback channels. Guardrail-bypass research at one of the largest model providers therefore sits outside a coordinated-disclosure track with a reward and a disclosure clock.

The findings land against a body of evidence that prompt injection remains the dominant failure mode in deployed agentic systems, a position reflected in OWASP's guidance and in Microsoft research published in May on remote code execution in AI agent frameworks. The pattern here is narrower and more concerning for defenders. Content-based guardrails, the primary control most enterprises have deployed, are structurally unable to inspect a payload that only exists in plaintext after the model has already decided to trust it.

Whether xAI ships a fix or acknowledges the report, whether Google revises its reward-program scope to cover guardrail bypasses, and whether AI security vendors move detection from input text to sandbox execution monitoring, is something to watch-out for.

This seems to work:

Researchers from Tracebit on Monday said they found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often all that was needed to shut down attacks from AI hacking agents. The prompts direct the attacking LLM to perform an action forbidden by its guardrails, the safety barriers AI developers erect to prevent it from taking harmful actions. The LLM responds by shutting down.

Examples are a prompt that orders the LLM to provide steps for developing inhalable Anthrax spores, or, in the case of LLMs from Chinese developers, make references to the iconic Tank Man from the 1989 Tiananmen Square massacre. Once the LLM encounters these forbidden commands, it no longer follows its existing commands. The researchers have named the technique context bombing.

Of course, this only works against agents that have guardrails. As we start to see more locally run AI models, we’ll see more attackers using LLMs with no guardrails.