钓鱼邮件藏隐形指令攻击 AI 收件箱助理

Sethian @theSethian原推发布于 2026.10.20

在 X 上打开原推

IT IS BECOMING F*CKING DANGEROUS. SCAMMERS NOW HIDE INVISIBLE ORDERS IN EMAILS THAT ONLY YOUR AI ASSISTANT CAN READ. Barracuda researchers caught phishing emails with two targets in one message. The lure is for you. A hidden block of instructions is for the AI that summarizes your inbox. You see a normal letter. Your assistant reads the raw code, where the commands hide in HTML comments, white text, zero-size fonts, Base64 blobs and invisible Unicode characters. In one example the hidden part tells the summary to add a priority action saying vendor payment details changed and need an update right away. The advice comes from an assistant the employee trusts, and it nudges them to wire money to the attacker. Another sits inside a resume and asks the screening AI to rate the candidate 10 out of 10 and push for an immediate interview. The sample also got past the filters with the same address in From and To, a trusted spam score and a public-sector domain. Assistants do more than summarize now. People plug Grok Bot into Gmail, and agents get mailboxes of their own where they read 2FA codes and answer by themselves. OpenAI admitted that prompt injection is "unlikely to ever be fully 'solved'", so the fix stays on your side: → Money, passwords and vendor changes always need your own click. → Give the agent a separate address, away from the one that gets your 2FA codes. → When a summary screams "urgent", open the original email before acting. Know someone who lets an AI summarize their inbox? Send them this.