Attackers Exploit AI Email Scanners to Evade Detection

Key Takeaways

• Attackers are employing “indirect prompt injection” to embed malicious instructions within seemingly benign digital communications like emails, documents, and calendar invites.
• This technique targets AI-powered email scanners and other automated AI tools, not human users directly.
• The goal is to manipulate AI agents into performing unsafe actions or exposing sensitive data by misinterpreting hidden commands as legitimate instructions.
• While not yet widespread, security researchers at Proofpoint have observed a growing underground market for tools and discussions around this attack vector.
• Organizations must treat all external content as untrusted, limit AI agent permissions, and implement human oversight for critical AI actions to mitigate this emerging threat.

Cybersecurity experts are reporting a concerning new trend where malicious actors are embedding covert instructions within everyday digital content, such as emails, documents, and calendar invitations. The primary target of these hidden directives is not the human recipient, but rather the artificial intelligence (AI) systems designed to scrutinize, summarize, and safeguard digital communications.

This sophisticated method, known as indirect prompt injection, transforms AI assistants from defensive mechanisms into potential attack vectors. An email or document that appears harmless to an employee could contain instructions that an AI mail agent interprets as legitimate commands, potentially leading to unauthorized actions or data breaches.

Analysts at Proofpoint have detected increasing discussions and active sales of tools facilitating these methods across various underground forums. This activity suggests that cybercriminals are actively developing scalable solutions for creating hidden prompts, even though widespread exploitation in real-world scenarios has yet to be extensively documented.

The rise of this attack vector is particularly significant as AI systems are increasingly integrated into the initial review process for inbound mail, attachments, calendars, and web content, often before human users interact with them. Criminals are now actively seeking to leverage this automated access, introducing a new layer of complexity and risk to traditional phishing and social engineering tactics.

Proofpoint said in a report shared with Cyber Security News (CSN) that while these emerging tools are still in their experimental phases, organizations should proactively prepare for their eventual proliferation. The researchers noted that subscriptions for such malicious tools are being advertised in criminal marketplaces, with prices starting at approximately $150 per month.

Hackers Are Hiding Commands in Emails

Indirect prompt injection exploits how an AI system processes external content, causing it to misinterpret concealed instructions as valid requests. Unlike a direct prompt attack, where a user directly inputs commands into a chatbot, this technique involves attackers embedding commands within content that an AI agent automatically processes without direct user interaction.

For example, one advertised email-generation tool creates messages containing “white-on-white” text. While a human recipient sees a standard email, the invisible text remains accessible to a mail-processing AI agent. This approach mirrors concerns previously raised regarding AI prompt injection attacks specifically targeting email-based workflows.

Attackers are also applying this concept to attachments. Proofpoint researchers have observed instances involving PDF and DOCX files that outwardly appear to be ordinary documents, such as a non-disclosure agreement. However, these files contain embedded text specifically designed to influence an AI scanning agent.

The severity of this threat is directly proportional to the permissions granted to the AI system. An AI agent configured merely to summarize messages poses a different level of risk than one capable of searching files, transmitting content, opening external links, or connecting to cloud services. The danger significantly escalates when an AI tool can execute commands without explicit human authorization.

Consequently, security teams must adopt a policy of treating all external content as inherently untrusted, regardless of its familiar format. Implementing robust measures to separate untrusted text from system instructions, strictly limiting the access privileges of AI agents, and requiring human confirmation for all critical actions are essential steps to mitigate the potential harm from concealed commands.

Calendar Invites Expand Risk

Beyond emails and documents, cybercriminals are also developing prompt-injection generators for calendar invitations. Malicious instructions can be subtly integrated into an event description, disguised as a meeting agenda. This allows an AI assistant, tasked with summarizing calendar content, to process the malicious code without the recipient ever having to click a link or formally accept the invitation.

This represents a significant evolution from traditional calendar phishing tactics, which typically rely on a user opening an invite or navigating to a linked page. With indirect prompt injection, an AI agent may inspect an invitation as part of its routine operations, echoing the risks associated with weaponized calendar files.

Proofpoint has also identified a burgeoning interest in embedding prompts within malicious advertisements and webpages. These hidden commands can be concealed within HTML code, image alternative text attributes, minuscule fonts, or other elements that a human visitor might easily overlook, yet are fully processed by automated browsers or AI assistants.

Organizations must thoroughly evaluate all points where AI tools ingest email, files, calendar data, and web content. Strict access controls around sensitive data and actions are paramount. Employees should continue to report any suspicious messages or unexpected invitations, while security teams remain vigilant for evolving phishing campaign tactics that blend conventional delivery methods with sophisticated AI-focused manipulation.

While current research does not indicate a widespread campaign utilizing these specific techniques today, the active development and marketing of related tools underscore that attackers are strategically preparing for a future where AI systems are not just a line of defense, but a primary attack surface.

What You Should Do

• Implement Strict Access Controls: Limit the permissions and capabilities of AI agents, especially those processing external content. AI tools should only have access to the data and functions absolutely necessary for their operations.
• Isolate Untrusted Content: Ensure that AI systems are designed to clearly differentiate between core system instructions and content ingested from external, untrusted sources.
• Require Human Verification: For any critical actions an AI agent might take (e.g., sending emails, accessing sensitive data, initiating external connections), mandate a human approval step.
• Educate Employees: Continue to train users on identifying and reporting suspicious emails, attachments, and calendar invites, reinforcing that AI systems are not infallible.
• Monitor AI Tool Interactions: Log and audit the actions taken by AI email scanners and other automated AI tools to detect unusual behavior or unauthorized commands.
• Stay Informed: Keep abreast of the latest adversarial AI techniques and vulnerabilities to adapt defense strategies accordingly.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.