Attackers now hide instructions in phishing emails that people cannot see but an AI assistant may process: in HTML comments, invisible text, encoded data and zero-width characters. When the assistant summarises the inbox it may follow them, for example flagging a fake change of supplier bank details as urgent. Barracuda documented it on 7 October 2026. The NCSC says it may never be fully fixed, so limit what assistants can do.
Based on Barracuda's research of 7 October 2026, the NCSC's guidance of December 2025 and OpenAI's statement of December 2025. Checked 18 October 2026.
Key takeaways
- One email, two targets. Barracuda's research of 7 October describes phishing emails with an ordinary lure for the person, a password-protected attachment, and hidden instructions for the AI assistant that summarises their inbox.
- Four hiding places. HTML comments, invisible text, encoded data and zero-width characters: all invisible to the reader, and all able to reach an AI assistant, depending on how it processes the message.
- Not just email. The same trick hit an invoice (a fake "bank details changed" action), a CV (score me 10 out of 10), a support bot and a coding assistant.
- No filter will fully fix it. The NCSC calls language models "inherently confusable" and says prompt injection may never be properly mitigated. OpenAI says it is unlikely ever to be fully solved.
- What works. Limit what an AI that reads outside content can do. Keep people on payments, bank detail changes and hiring decisions.
- Train the people. Staff need to know that their assistant may read text they cannot see, so a summary can be wrong on purpose.
For twenty years, phishing has had one target: the person reading the email. Research published by Barracuda on 7 October describes a second one. As more staff let Copilot, Gemini, Claude or ChatGPT summarise and sort their inbox, attackers have started writing instructions for the assistant into the same message, hidden where the human cannot see them.
How the attack works
The sample Barracuda analysed looked like routine internal correspondence. The sender and recipient were the same mailbox, it carried a trusted spam score, and it came from a public-sector domain, so it passed the reputation checks most email filters rely on. Inside, it carried two attacks at once.
The human layer is familiar: a password-protected attachment, with the password helpfully in the message body, which many email security tools cannot look inside. The AI layer is new. If the recipient ignores the email, the hidden text tries to get their assistant to present it as legitimate or urgent in the inbox summary, nudging them back to it. Barracuda says injected instructions can also try to make an assistant drop its previous directions, request a transfer of funds, leak data or surface a fake urgent action, none of which the user can see.
Keep it in proportion. Barracuda has not said how widespread the campaign is, and the reports do not show that any of these attempts led to a payment or a leak. This is an early warning, not an epidemic. It is also the kind of warning that is cheap to act on now and expensive to act on later.
The four places instructions hide
Barracuda found four techniques turning up again and again. None of them is new to security teams. What is new is that an AI assistant may now process the same emails, and depending on how it handles the raw content, the hidden text can reach it. Some assistants can also act on what they read.
Notes in the code
Comment tags that never display in the mail client, but sit in the raw source the AI reads.
White on white, size zero
Text styled so it takes up no visible space on screen, yet is still part of the document the model processes.
Hidden in a data block
Instructions buried inside an encoded string, such as image data, that an automated pipeline may decode to text.
Invisible letters
Unicode characters with no width, woven through ordinary text to smuggle or disguise content.
It is not just email
Barracuda found the same trick aimed at four other kinds of system that businesses are adopting fast. Each maps to a team, and each has a control that does not depend on the AI noticing anything.
| Team | What the hidden text tried to do | What stays with a person |
|---|---|---|
| Finance | An invoice email told the summarising AI to add a priority action saying the supplier's bank details had changed. | Bank detail changes are confirmed by phone on a number you already hold, whatever any summary says. |
| HR | A CV hid text telling an AI screening tool to score the candidate 10 out of 10 and recommend an immediate interview. | AI can sort a pile of CVs. A person decides who is shortlisted, and nobody is advanced or rejected by the tool alone. |
| Customer service | A message posed as an authorised maintenance or admin request and asked a support bot to reveal its own configuration. | Bots never change mode or reveal settings on request. Admin happens through admin tools, not chat. |
| IT and development | Poisoned documentation on a web page told a coding assistant to slip a line that sends login credentials elsewhere into any authentication code it wrote. | AI-written code is reviewed before it ships, and assistants only draw on sources you trust. |
The HR example is worth a second look, because the National Cyber Security Centre uses almost the same one to explain the whole problem: a recruitment system asked to score CVs, and a candidate who hides a line telling it to approve them for interview. If your team has started using AI to screen applications, assume some of them already contain text you cannot see.
Why a better filter will not fix it
The natural response is to ask IT for a filter that catches the hidden instructions. Do ask, because stripping hidden content helps. But the UK's National Cyber Security Centre has been blunt that this is a different kind of problem. In December 2025 it published a blog explaining that prompt injection is not like SQL injection, the classic website attack that was eventually designed out. Inside a large language model there is no hard line between data and instructions, only the next most likely word, so the NCSC describes these systems as "inherently confusable".
"There's a good chance prompt injection will never be properly mitigated in the same way."
National Cyber Security Centre, Prompt injection is not SQL injection (it may be worse), 8 December 2025The NCSC goes further: "Beware any that claim they can 'stop' prompt injection," it says, because a filter looking for phrases such as "ignore previous instructions" will always miss the next rewording. OpenAI said much the same about its own agents a fortnight later, describing prompt injection as "unlikely to ever be fully 'solved'". Its demonstration showed an agent asked to draft an out-of-office reply that found a malicious email in the inbox and sent a resignation letter instead, until a security update taught it to flag the attempt.
The big names have been caught before. In July 2025 a researcher showed that white, zero-size text in an email could make Gemini's summary in Gmail display a fake password warning with a phone number to call; Google fixed it. In June 2025 Microsoft fixed EchoLeak, a critical flaw in Microsoft 365 Copilot in which a crafted email with hidden instructions could make Copilot gather internal data, with no evidence it was used in the wild. Each was patched. The pattern was not, because the pattern is how these models work.
The rule that does work: limit what the reader can do
If you cannot reliably stop an AI being fooled by what it reads, the answer is to limit what a fooled AI can do. The NCSC puts it in one line: "don't let an LLM processing emails from random external people have access to privileged tools." An assistant that only summarises cannot act on its own, but a misleading summary can still lead a person to act, for example by paying a fake invoice or changing bank details. One that can send, pay, change records or forward files on the strength of an email it has just read is the combination to avoid.
This is the same thinking as the four things every AI agent needs: a written scope, a log someone reads, a kill switch someone has tested, and a named owner. It matters more now that always-on agents from several major labs can read mail and act on it in the background. Barracuda's own advice lands in the same place: treat anything that arrives from outside as data, never as instructions, and keep a person's approval on payments and supplier changes.
Every business already has a rule that nobody changes bank details because an email said so. That rule now has to cover the AI that reads the email too.
Rod Doyle, Director, TESS GroupWhat to do this week
Treat AI summaries as a convenience, not a verdict
Do: tell staff that "urgent" or "verified" in an AI summary is not evidence of anything, and that summaries never authorise an action.
Why: the attack works by making the summary vouch for the email. Researchers who found the Gemini flaw gave the same advice: summaries are informational, not authoritative.
Re-state the bank details rule
Do: any change to supplier or payroll bank details is confirmed by phone on a number you already hold, with no exceptions for anything an assistant flagged.
Why: Barracuda's invoice example is ordinary payment fraud with an AI middleman. The old control still works, if people know it covers the new route.
Narrow what email-reading assistants can do
Do: list every tool that reads your mail, from Copilot and Gemini to agents and plug-ins, and check what each can do besides read. Switch off sending, forwarding and record changes wherever reading and summarising is all you need.
Why: the NCSC's rule: an AI processing mail from outsiders should not hold privileged tools.
Ask IT or your email provider two questions
Do: ask whether hidden text, comments and invisible characters are stripped before content reaches AI tools, and whether instruction-like text is flagged or logged.
Why: it lowers the odds. The NCSC is clear it will not remove them, which is why the other five steps matter.
Keep a person on CV decisions
Do: if you use AI to screen applications, make sure a person decides every shortlist and every rejection.
Why: hidden "rate this candidate highly" text is the oldest trick in this book, and it is most dangerous in tools that decide alone.
Update your phishing training for AI
Do: add one slide to awareness training: your AI assistant may read things you cannot see, so its summary can be wrong on purpose.
Why: the people configuring and using these tools are the control that does not depend on the model getting it right.
We spent years teaching people not to trust a link they could not see. Now the risky part is text nobody can see at all.
Lisa O'Reilly, Director, TESS Group
Where the training fits
The people who set these tools up need to know how they fail.
On our Level 4 AI and Automation Practitioner apprenticeship, an apprentice's agent does not go live until they have written its safety case: guardrails, monitoring, a kill switch and escalation paths. The programme's modules on AI integration and assurance, and on piloting, testing and assuring, are where apprentices learn to design and test agents so that a misled one cannot do much harm. The next inductions are Friday 20 November 2026, Monday 14 December 2026 and Monday 25 January 2027, live online, and there is a free AI and Automation taster day on Wednesday 2 December.
For the managers who approve these tools rather than build them, the AI Adoption and Governance unit at Level 5 covers risk, oversight and accountability, and there is a free taster on Wednesday 4 November.
TESS Group has trained UK employers since 2009, is rated Good by Ofsted at its last inspection (June 2025), UKPRN 10031093, and delivers live online to employers across England.
Not sure your team would spot this? Book 30 minutes with Rod to talk through AI training for the people who set up and use these tools.
Book a 30-minute call with Rod → or use the contact formThe honest summary
- What is new: phishing emails that carry a normal lure for the person and hidden instructions for the AI assistant summarising their inbox.
- Where it hides: HTML comments, invisible text, encoded data and zero-width characters.
- Beyond email: invoices, CV screening, support bots and coding assistants have all been targeted the same way.
- Why it persists: the NCSC and OpenAI both say prompt injection is unlikely ever to be fully fixed.
- What works: limit what an AI that reads outside content can do, keep people on payments and hiring, and train staff that a summary can be wrong on purpose.
Frequently asked questions.
What is prompt injection in a phishing email?
It is text hidden in an email that is written for an AI system rather than for the person. When an AI assistant reads the email, for example to summarise an inbox, it may treat the hidden text as instructions, such as presenting the message as urgent or adding a fake action. Barracuda documented phishing emails combining this with an ordinary human lure on 7 October 2026.
How do attackers hide instructions from people?
Barracuda found four common techniques: HTML comments that never display in the mail client, text styled to be invisible such as white or zero-size text, instructions buried in encoded data such as image strings, and zero-width Unicode characters woven through ordinary text.
Which AI assistants are at risk?
Any assistant or agent that reads email or other outside content, including email summarisers and assistants connected to a mailbox. Barracuda did not name specific products. Earlier, since-fixed examples affected Gemini in Gmail in July 2025 and Microsoft 365 Copilot (EchoLeak) in June 2025. The risk rises with what the assistant is allowed to do after reading.
Can prompt injection be fully prevented?
Probably not. The UK's National Cyber Security Centre says there is a good chance prompt injection will never be properly mitigated in the way SQL injection was, because language models do not separate data from instructions. OpenAI has said it is unlikely ever to be fully solved. The practical goal is to reduce the likelihood and limit the impact.
What should employers do first?
Tell staff that AI summaries never authorise an action; confirm every bank detail change by phone on a known number; switch off sending, forwarding and record changes for assistants that only need to read; ask IT whether hidden content is stripped before it reaches AI tools; keep a person on hiring decisions; and add AI to phishing awareness training.
Does this affect AI CV screening?
Yes. Barracuda found a CV with hidden text telling an AI screening tool to rate the candidate 10 out of 10 and recommend an immediate interview, and the NCSC uses a near-identical example to explain prompt injection. If you use AI to screen applications, keep a person deciding every shortlist and rejection.
Is this covered in AI training?
It should be. On the TESS Level 4 AI and Automation Practitioner apprenticeship, an apprentice's agent does not go live until they have written its safety case, and its modules on AI integration and assurance and on piloting and testing are where apprentices learn to design and test agents safely. Managers can take the Level 5 AI Adoption and Governance unit.
Rod Doyle is a Director of TESS Group, an Ofsted-rated Good apprenticeship provider founded in 2009 that delivers the AI and Automation Practitioner Level 4 (ST1512) and AI leadership units live online across England. He writes the employer guides on this site. LinkedIn.
Sources: Barracuda, Threat Spotlight: Email attacks target both humans and AI in the same message, Guruprasad Kenja, 7 October 2026, for the campaign, the four techniques, the examples and the recommended defences; Infosecurity Magazine, 7 October 2026; NCSC, Prompt injection is not SQL injection (it may be worse), 8 December 2025, and the accompanying NCSC news release, 10 December 2025, quoted directly under the Open Government Licence; OpenAI, hardening ChatGPT Atlas against prompt injection, 22 December 2025, as reported by TechCrunch, which also carries the framing of risk as autonomy multiplied by access from Rami McCarthy of Wiz; BleepingComputer on the Gemini summary flaw reported through 0DIN, July 2025; Microsoft, CVE-2025-32711, EchoLeak, June 2025. The illustration of the hidden lines is ours. Checked 18 October 2026. TESS Group delivers AI apprenticeships and has a commercial interest in employers choosing structured training.