Your Email AI Assistant Could Be Turned Against You, Researchers Warn
Security researchers have shown how the AI chatbots built into modern email platforms can be hijacked to impersonate colleagues, steal account access, and set up financial fraud, all without a single suspicious link.
Key points
- Researchers demonstrated that AI email assistants can be manipulated by attackers to bypass standard security filters.
- The attack methods include impersonating trusted employees and taking over executive email accounts.
- Financial fraud is a viable end goal, according to the research findings reported by SecurityWeek.
- No single CVE has been assigned yet; the vulnerabilities described are design-level weaknesses in how AI assistants handle untrusted content.
The AI assistant built into your email inbox is supposed to save you time. Researchers have now shown it can also be turned into a silent accomplice for criminals.
Security researchers recently demonstrated a series of attacks against AI-powered email chatbots, the kind now bundled into platforms like Microsoft Outlook and Google Gmail. The findings, first reported by SecurityWeek, show how these assistants can be weaponised to do things their makers never intended. We reported a closely related technique on 30 July, when a researcher showed Copilot copying attacker instructions out of Word files and into finished documents.
How does the attack actually work?
The core trick is prompt injection: an attacker hides instructions inside an ordinary-looking email. When the AI assistant reads that email to draft a reply or flag it as urgent, it also reads the hidden instructions and obeys them.
Think of it like a forged sticky note slipped into a stack of memos. A human reader might spot it. An AI assistant, trying to be helpful, just follows the note.
From there, the researchers showed four realistic outcomes. The assistant could impersonate a trusted colleague in follow-up messages. Credential harvesting becomes possible, where the assistant is tricked into collecting the usernames and passwords that prove who you are. An attacker could take control of an executive's account. And the assistant could nudge an employee into authorising a fraudulent bank transfer.
Should ordinary employees be worried?
Yes, especially anyone who handles invoices or payment approvals by email. Nothing looks wrong. The email arriving in your inbox may appear completely normal, because the threat lives inside the AI layer sitting between you and your messages.
Standard advice like "don't click suspicious links" offers no protection here. No link is required. The assistant acts on your behalf before you even read the message. Our earlier piece on what phishing looks like and how to catch it assumed you could spot the bait. This attack removes that assumption entirely.
| Attack technique | What it does to you |
|---|---|
| Prompt injection via email | Hides criminal instructions inside a normal-looking message |
| AI-assisted impersonation | Makes replies appear to come from a trusted colleague |
| Credential harvesting | Tricks the assistant into collecting your login details |
| Account takeover | Lets attackers control an executive's inbox |
| Fraudulent payment setup | Steers staff toward approving fake transfers |
No patch exists for these weaknesses. They carry no CVE because they are not discrete bugs in a fixed version; they are flaws in the way AI assistants are designed to process any text they encounter, including text written by criminals.
Vendors including Microsoft and Google are aware of prompt-injection risks as a category, and both publish guidance on responsible AI deployment. Defenders should check whether AI summarisation features can be restricted to internal mail only, and treat any AI-generated suggestion touching money or credentials as requiring a manual check.
The judgement worth making here: this class of attack is not theoretical and it does not require a sophisticated target. Any organisation that has switched on an AI email assistant without reviewing what it is permitted to do on a user's behalf has already made a decision it may not have intended to make.
Common questions
Do I need to click anything for this attack to work?
No. The hidden instructions are processed automatically when the AI assistant reads the email. You may never interact with the malicious message directly.
Which email platforms are affected?
The research describes a design-level weakness that could affect any email platform with a built-in AI assistant. No specific product was named as uniquely vulnerable in the published findings.
