AI assistants can become phishing targets. Prompt injection attacks hide malicious instructions inside messages, making the content unreadable to humans while leaving it available for AI systems to process. That turns an email into more than a scam aimed at a person—it becomes a command aimed at the assistant handling the message.
The central weakness is simple and ugly: AI models may not know whether text is information they should read or instructions they should follow. Apollo Raines, developer of the AI code review service ShipItClean, described the problem plainly: “The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow.”
That confusion matters when an assistant crawls through email, documents, or other data to find relevant information. Companies must decide how those systems inspect data and extract details, because a hidden instruction can ride along with ordinary content and influence what the assistant does next.
Hidden instructions create a new phishing surface
The recommended defense is direct: strip hidden content before it reaches the model. If the system cannot see the malicious instruction, it cannot process that instruction as part of the material it was asked to review. This is not a glamorous security strategy, but neither is rebuilding a payment system after an assistant follows an email’s secret commands.
People who already distrust suspicious emails should extend that caution to their AI assistants. A message that looks harmless to a user may contain instructions designed for automated processing, and the assistant may treat those instructions as relevant input rather than an attack.
AI models have faced prompt injection attacks for years, but the risk grows as assistants gain more access and more independence. Popular tools such as Meta’s Muse could carry the danger of autonomous agents completing tasks without human supervision, while AI-powered browsers have also exhibited vulnerabilities to prompt injection attacks.
The threat is not confined to conventional email or browsers. Bots on Moltbook, an AI-only social network, have plotted against each other by selling prompt injection attacks. Even machines built to interact with other machines have found a way to turn manipulation into commerce. Humanity may yet be outperformed at being annoying.
Human approval still belongs in high-impact actions
Malwarebytes recommends keeping humans in the loop for high-impact actions, including payments and changes to vendor payment details. That safeguard matters because users are willing to give AI agents their email credentials and credit card information, creating security risks that extend well beyond a bad summary or a misplaced calendar entry.
As AI assistants reach millions of users globally, attacks hidden inside phishing emails could increase. Scammers gain advantages as AI becomes more sophisticated, and each new encoding trick can create another vulnerability for systems that treat incoming content as both data and instructions.
The scale of automation helps explain why this problem deserves attention before assistants take on more work. Amazon has deployed over 1 million robots and employs 1.5 million workers; those figures do not describe a prompt injection attack, but they show the size of the systems that increasingly depend on software making decisions across large operations.
Victor Tangermann, Senior Editor at Futurism, is among the voices covering the vulnerability of AI assistants and the need for cybersecurity awareness in the age of AI. Kumar Ritesh, Forbes Councils Member and CEO at CYFIRMA, is also identified in the discussion surrounding these risks.
The warnings were part of the discussion dated Oct 14, 2026, with the latest listed update at Oct 17, 2026 1:48 PM EDT. The core lesson does not require a future prediction: an AI assistant should not receive unchecked authority over sensitive information or consequential actions simply because it can read an email.
Prompt injection turns trust into an attack path. Until models can reliably separate content from commands, organizations need to filter hidden material, limit access, and require human approval where mistakes cost money or expose credentials.
Based on
