The new AI attack: How malicious commands are hidden inside innocent emails
White text, tiny fonts, and instructions hidden within email threads can turn seemingly innocent messages into a security risk for AI agents. Shaked Ilan, a senior security researcher at Microsoft Israel R&D, explains how attackers influence these agents and what measures are being taken to stop them.
More and more organizations are connecting AI agents to email, calendars, and documents to summarize information, find answers, and perform actions on behalf of users. However, as these agents gain more capabilities, attackers are beginning to treat them as a primary target.
"In the past, an attacker would try to convince a person to click a link or open a file," explains Shaked Ilan, a senior security researcher at Microsoft Israel R&D. "In a Prompt Injection attack, the attacker is not trying to trick the person reading the email, but the AI agent processing it."
The Mechanics of Hidden Threats
Attackers embed instructions specifically for the agent inside an email that appears innocent. When the agent processes the message, it may interpret the hidden text as a command and act accordingly. According to Ilan, these instructions could cause the agent to collect information from other emails, reveal available systems and tools, forward documents to external addresses, or alter information presented to the user.
One illustrative example involves payment threads. An attacker might insert an instruction causing the agent to summarize the correspondence by stating that bank account details have changed. From the user's perspective, the agent is simply summarizing the email, but in practice, it is being manipulated by embedded content.
Methods of Concealment
Instructions do not need to be visible to the human eye. Ilan notes that they are often hidden using:
-
White text on a white background.
-
Tiny font sizes.
-
Insertion into long email threads that are unlikely to be read in full.
-
Characters and encodings that are invisible to the user.
This risk has been demonstrated in security research, such as the EchoLeak study (2025), which showed how embedded instructions could force an AI agent to leak information. Similar methods have been observed in academia, where hidden text in articles was used to influence AI-based peer review systems.
Protection and Boundaries
The distinction between a chatbot and an AI agent is critical: while a chatbot error may result in an incorrect answer, an agent error can lead to unauthorized actions, such as sending messages or accessing sensitive systems.
In response to these risks, Microsoft has developed an additional layer of protection within Microsoft Defender for Office 365. The system analyzes message content during delivery, identifying malicious instructions before the AI agent can read them. To stay ahead of new attack vectors, the Microsoft research team in Israel is using millions of synthetic attack examples to train and test defense systems.
"The goal is not to stop using AI agents, but to build clear boundaries around them," says Ilan. "One should grant the agent only the permissions it truly needs, require human approval for sensitive actions, and monitor its activity. Think of an AI agent like a new employee: it can be highly efficient, but you wouldn't give it access to all systems on the first day without supervision."
