Your email app can read your inbox for you, and so can the assistant built into your phone. Someone has now written a scam aimed at that helper instead of at you — in words you will never see.
What researchers just found
Barracuda, a company that filters email for businesses, published its findings on 7 October. Its researchers took apart a phishing email — a fake message built to steal a password — and found two messages inside one envelope.
One message is for you: the old, familiar trick. The other is written for the program that summarises your inbox. You cannot see the second one. The program reads it without noticing that it was never meant for you.
On screen the email looks like ordinary office mail. The sender and the receiver are the same address, it comes from a public-sector domain, and it carries a good reputation score, so the usual filters wave it through.
The visible part does the old job. A document is attached, locked with a password, and the password is printed in the message so that you can open it. Security scanners cannot inspect a file they cannot open, and opening it leads to stolen logins or software that takes over the computer.
The second message is written in invisible ink
The hidden half is the new part. It is a set of commands that no person reads but the assistant does. Researchers call this a prompt injection: an instruction smuggled into ordinary content so that the program reading it treats a stranger’s words as its owner’s orders.
Four ways of hiding it turned up again and again. Commands tucked into comment lines that never appear on screen. Text shrunk to nothing or coloured white on white. Blocks of scrambled letters that a computer turns back into readable words. And invisible characters slipped in between the letters you do see.
In one real example, a hidden line in an invoice told the summarising assistant to add an urgent task: change the supplier’s bank details. The employee then read a summary that appeared to contain a genuine instruction to pay. Nobody had typed those words. The computer wrote them because a stranger told it to.
Image credit: “Chatbot lesend” by Robert Wagner, licensed CC BY 4.0, via Wikimedia Commons.
Why this matters to you
Because you trust the summary. When a helper tells you that a message is urgent and safe, most people stop looking — checking is the whole reason for having the helper. So the scam does not need to fool you. It needs to fool the program you already believe.
The same trick does not care which assistant it meets. In the same report, a job applicant hid text telling screening software to rate them ten out of ten and offer an interview. A support chat was asked to reveal its own settings by pretending to be an approved maintenance request. A web page carried a line telling a coding helper to add a password-stealing line to every piece of code it produced.
None of that needed a broken product. The assistant did what the text around it told it to do — which is exactly what it is built to do.
What you can actually do
- Treat a summary as a second opinion, not a guarantee. If your assistant says an email is urgent or safe, open the email and check who really sent it.
- Never open a locked attachment whose password arrives in the same message. A real company does not send documents that way.
- Before any payment, or any change of bank details, phone the company on a number you already have — from your own paperwork, not from the message.
- If you do not use the summarising feature, switch it off. It has its own setting in your mail app; look for a switch with words like “summaries” or “smart features”.
- Slow down whenever a message asks for money, a password or a code. Urgency is the one tool every version of this scam shares.
- Keep your phone and your mail app updated. Updates quietly close the holes these tricks rely on.
Common misunderstandings
Myth: text I cannot see cannot affect me
Hidden text is not hidden from the program. White words on a white background are invisible to your eyes and perfectly readable to the assistant, because it reads the raw message rather than the picture on your screen.
Myth: an AI assistant will spot the scam for me
An assistant is built to be helpful and to follow the text it is handed. It is not a security guard, and it cannot tell a stranger’s instruction from your own. That is the weakness being used.
Myth: this is only a problem for companies
The examples come from office mail, but the method works on anything a helper reads on your behalf: your personal inbox, a shared document, a web page you asked it to summarise. The more you let it read, the more places the trick can hide.
What to watch for next
Barracuda did not say how widely this campaign is being used, so treat it as a method rather than a wave. Hidden text has already turned up in invoices, job applications, support chats and web pages, and it will follow the assistants into whatever they are asked to read next.
The defence the researchers recommend is one you can apply yourself: treat anything that arrives from outside as information to read, never as orders to follow. Filtering tools are being built to strip out invisible characters, but no single check catches every version.
The one thing to remember
A hidden message is not hidden from the assistant that reads your mail. It is hidden only from you.
So never act on a message because a computer said it was important. Act on it because you checked it yourself.