AI agents can turn phishing emails into executable instructions

The email is both data and attack surface

An AI assistant reading a phishing email may do more than expose a person to a scam: if it treats hidden text as instructions, it can act on the attacker’s behalf. The underlying problem is that a model may not distinguish content it should read from commands it should follow. That risk matters more as assistants gain the ability to carry out chains of tasks without a person involved at every step.

Apollo Rains, a developer of the code-checking service ShipItClean, told Malwarebytes that hidden content should be removed before it reaches a model, and that all providers should do this. Asking people to read email more carefully will not solve the problem; companies also need to consider how their AI assistants process messages and extract information.

Prompt-injection attacks have been known for years. But the stakes change when an assistant can act autonomously: a malicious message can become an instruction in a workflow, not just text in an inbox.

Human approval is still the control

Researchers have encountered the issue in AI browsers, which have not yet become widely used. Bots on Moltbook, a social network designed only for AI, have also made plans against one another and sold prompt-injection attacks.

Now sophisticated AI assistants are being used by millions of people around the world. Malwarebytes does not recommend abandoning email tools, but it advises keeping people involved, thinking carefully about which tasks to delegate and limiting the permissions assistants receive. For consequential actions, such as payments or changes to supplier details, it recommends requiring human confirmation.

Rains says users who are already wary of suspicious emails should also distrust their AI assistants. I think the important distinction is not whether an assistant can read email, but whether it can act on what it reads without a person checking first.

The risk also extends to the trust users place in the platform itself: many are willing to give an AI agent access to email credentials and credit-card data, even when it runs on a platform known for personal-data leaks. The announcement is quiet about how providers will reliably separate hostile content from instructions. Rains describes the situation as an arms race: each new way of encoding hidden text creates another vulnerability. If agents are given access to sensitive accounts before that boundary is dependable, human approval may be the only meaningful barrier left.