Most of us think we’re smart enough not to click on anything in a suspicious email crudely impersonating a trusted organization. But more and more of us are using AI agents – and they can be naive enough to fall into a trap. Needless to say, it’s you – not the software – who’s going to suffer financial damages.

AI agents – like Meta’s Muse, for example, are marketed as assistants able to carry out tasks on your behalf. They can browse the web, open browsers, fill out forms, send emails, organize schedules, and book travel or dinner reservations – all autonomously.

But they can also fall for phishing scams. As Malwarebytes, a cybersecurity software company, warns, AI assistants can fall prey to prompt injection attacks – hidden instructions designed to influence the victim’s AI.

Essentially, you’re not the target anymore. As well as trying to persuade you, the human, attackers are also attempting to influence the AI agent reading your messages on your behalf.

Learn to distrust your AI agent

“You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender. Then you asked your AI assistant to summarize your inbox,” the blog post explains.

“Could the message you wisely avoided find its way back onto your to-do list – only this time presented as an urgent recommendation from a tool you trust?”

Those instructions are often impossible to read for humans but leave “content available for an AI system to process.”

This means that it’s not enough to simply ask people to look more carefully at their emails. Instead, users and companies must decide how open the door to their inbox will be for their AI assistant.

According to AI code review service ShipItClean developer Apollo Raines, people should learn to distrust their AI assistant.

The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow,

AI code review service ShipItClean developer Apollo Raines said.

Recent research from Barracuda described emails designed to target both audiences at once.

For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.

Keeping the human in the loop

By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could convince the assistant to describe the email as legitimate or urgent, encouraging you to revisit it.

In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.

The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation,

Malwarebytes said.

Prompt injection attacks are already occurring. But the fact that AI agents are already used by millions worldwide is significantly increasing the threat, the cybersecurity company thinks.

Malwarebytes’ solution is to keep the human in the loop for now. You don’t need to abandon the AI agent – but you need to consider what you trust them to do and what permissions you give them.

“Require human approval for high-impact actions like payments and changes to vendor payment details. Approval should include checking the underlying request, not simply accepting the assistant’s recommendation,” Malwarebytes said.