2026-10-07 · 2026-Q4
Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox Assistant
Who actually said "do this"?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
AI assistants that summarize and prioritize email; Barracuda also describes variants against resume screeners, support bots, and coding assistants
Impact
Barracuda documented an in-the-wild email that posed as internal mail (same sender and recipient, sent from a public-sector domain, trusted spam score) and paired a password-protected attachment for the human with hidden instructions for the AI. The instructions were concealed in HTML comments, CSS-invisible text, Base64, and zero-width characters, and aimed to make the summary present the message as legitimate and urgent, including requests to change vendor payment details. No volume figures were given
Root cause
Assistants ingest unrendered email content as instructions, and their summaries feed decisions such as payments without a check against the original
Sources
Catalog
Cite this: AgentProv incident record: Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox Assistant (2026-10-07). https://agentprov.com/incidents/2026-10-07-barracuda-phishing-emails-carry-hidden-prompt-injections-for-the-recipient-s-ai
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-06Signals Corps: Prompt Injection Shows Up in HTTP Response Headers Aimed at Browsing AgentsL2Instruction