Lots of us now let an AI assistant skim the inbox for us: "summarise my emails", "what needs my attention today?". It's a real time saver. But researchers have found phishing emails with a second, hidden message written for the AI rather than for you, telling it to make a scam look urgent and genuine.
Here's how it works, and the simple habits that stop it costing you money.
What happened
On 7 October, email security firm Barracuda described a phishing campaign that targets two readers at once: the person who owns the inbox and the AI tool that summarises it. Infosecurity Magazine reported that a single message was built to fool both.
For the human, the sample email used an old trick: a password-protected attachment, with the password in the email itself. That stops many security filters looking inside the file. Open it, and you risk handing over your login or installing malware. The email also looked like internal post. The sender and recipient addresses were the same mailbox, it had a trusted spam score and it came from a public-sector domain, which helped it slip past reputation checks.
For the AI, the email carried hidden instructions. If you ignored the email, those instructions could nudge your assistant into presenting it as legitimate or urgent, so you go back and open it after all. Barracuda didn't say how widespread the campaign was.
How do you hide a message from a human?
Very easily. An email is really a small web page, and plenty of it never appears on screen. Barracuda named four common hiding places:
Comments in the email's code. Notes that your email app doesn't display, but an AI reading the raw message does.
Invisible text. White text on a white background, or text styled to be zero size.
Encoded text. Instructions scrambled into a format (Base64) that looks like gibberish to us.
Zero-width characters. Characters that take up no space at all, so the words are there but you can't see them.
Why does this work on AI?
Large language models read everything as one stream of text. They struggle to tell the difference between information they've been given and instructions they should follow. The UK's National Cyber Security Centre warned in December 2025 that these tools are "inherently confusable" and that prompt injection, as this trick is called, "may never be totally mitigated". Its advice is to stop hunting for a silver bullet and instead limit what an AI system can access or do.
Barracuda gave real-world examples that show where this leads. One invoice email hid an instruction telling the summarising AI to add a fake "priority action" to change a supplier's bank details. Another hid text in a CV telling an AI screening tool to rate the candidate 10 out of 10.
What this means for UK small businesses
This matters because small firms have taken to AI quickly. A Simply Business survey of 1,842 UK small business owners found 47% now use AI, up from 22% a year earlier. Yet only 19% said they felt very confident using it day to day.
The fake bank details example is the one to worry about. Report Fraud says victims of payment diversion fraud reported losing more than £101 million in 2025/26, across 3,657 reports, and warns that criminals are increasingly using AI to write convincing emails and copy writing styles. An AI summary that says "urgent: supplier has new bank details" adds a fresh layer of false confidence to an old scam.
The good news is that the defences are the ones that already beat phishing: a human check before money moves, and a healthy habit of opening the real email rather than trusting a one-line summary.
What to do this week
Make payment changes a human-only decision. No supplier bank details change on the strength of an email, or an AI summary of one. Call the supplier on a number you already have. Barracuda's own advice is to require human approval for payments and supplier changes.
Treat summaries as a shortcut, not the truth. If an AI assistant flags something as urgent, especially money, logins or attachments, open the original email and read it yourself.
Be wary of password-protected attachments. An unexpected file with the password in the same email is a classic way to get past filters. Check with the sender another way before opening it.
Limit what your AI tools can do. Following the NCSC's advice, check which assistants can read your mailbox, send emails or reach shared files, and switch off what you don't need. Use the business tools your firm has approved, not personal accounts.
Tell your team in five minutes. Explain that emails can contain hidden text written for AI, and that "the assistant said it was fine" is never a reason to pay, click or log in.
Sophia Says
I love that small teams are using AI to claw back time, and I'd never tell anyone to stop. But this story is a reminder that an AI assistant reads every word in an email, including the ones you can't see. Criminals know that, so they've started writing to it. The answer isn't panic, it's a rule: summaries help you decide what to read, never what to pay.
HackRisk is built to catch the things that make this scam work. I watch for your staff logins turning up on the dark web, show you how exposed your business looks from the outside, and flag weak spots in your email setup and websites before criminals use them. And with phishing simulations and short training, your team learns to pause, open the real message and pick up the phone. That pause is what stops the money leaving.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Stolen logins from phishing: our Dark Web Scan alerts you when staff email addresses and passwords appear in leaks.
Staff tricked by convincing emails: Phishing simulations and security awareness training build the "open it and check" habit.
What attackers can see about you: a Recon Scan maps your public footprint, including the email and domain details criminals use to impersonate you.
Weak spots in your systems: a Vulnerability Scan finds unpatched and misconfigured services before they're used.
Suppliers and fake bank details: Supply Chain Risk helps you understand which suppliers could be used against you.
Get your free HackRisk report
Find out what attackers can already see about your business, in plain English, with clear next steps. Get your free HackRisk report.