AI assistants face security risks from hidden email instructions

Security researchers have identified a growing threat known as prompt injection, where attackers hide malicious instructions within emails to manipulate AI assistants. These commands are designed to be invisible to human recipients but are easily read by AI systems processing the data.

Common methods for concealing these instructions include using HTML comments in the source code, employing zero-point font sizes, or using white text on a white background. More sophisticated attacks involve encrypting content or placing instructions within protected attachments, which many AI systems may open automatically.

If successful, these injections can trick an AI into performing unauthorized actions, such as instructing an employee to change payment details or inserting high-priority fabricated tasks into a workflow. While AI models themselves are text generators that require external programs to execute actions like sending emails, the integration of these models into automated workflows creates new vulnerabilities.