The phishing email now has two readers, and the second one is your AI assistant

You deleted the suspicious invoice. Then your inbox assistant produced its morning summary and put it back in front of you, marked urgent.

That is the attack Barracuda's threat team described on 6 October, and it is a neat piece of work. A single email is written for two audiences. The visible half does the usual job on the human: a password-protected attachment, a familiar sender address, something that needs doing today. The invisible half is aimed at whatever AI is reading your mail on your behalf. Barracuda found those instructions tucked away four different ways: inside HTML comments, in text styled by CSS to be white or zero pixels tall, encoded as Base64, and written in zero-width characters that take up no space on screen. In one real sample, a hidden block told the summarising assistant to add a priority action item about changing a supplier's bank details. The human reads a tidy summary from a tool they trust, and goes and moves the money.

The underlying problem has no quick patch. A language model reading your email cannot reliably tell the difference between text it is meant to describe and text telling it what to do. Barracuda's recommendations are mostly about stripping hidden content out before the model ever sees it, and insisting a human signs off anything involving a payment.

For the rest of us the habit is simple enough. An AI summary is a tip, not a verdict. If it flags something involving money, an account or a password, open the actual message and look at it yourself, and confirm any change of bank details using a phone number you already had. The payoff for most phishing is still something quietly installed afterwards, and Tendvane's safety check goes through what is on your PC and flags the things that arrived without being asked for.