Polymarket says cybersecurity experts warn AI agents are highly vulnerable to phishing emails with hidden instructions
JUST IN: Cybersecurity experts warn that AI agents are highly vulnerable to phishing emails containing hidden malicious instructions.
Context
Agents that read email can be steered by text a person never sees, which matters as more people give bots access to their inboxes.
This is a secondhand news alert from the prediction market Polymarket, which did not name the experts or link a source. Security firms published research on hidden instructions in emails earlier in October, so the warning is not new.
Deep dive
On October 17, Polymarket posted a news alert saying cybersecurity experts warn that AI agents are highly vulnerable to phishing emails containing hidden malicious instructions. It gave no source, names or details.
The warning matches research published earlier in the month. On October 7, the security company Barracuda wrote that attackers are building emails aimed at both people and AI assistants, hiding instructions that a person reading the message would not notice. It described four ways of hiding text: HTML comments, text made invisible with styling, Base64 encoding and zero width characters. An assistant that summarizes or acts on the email may read and follow those hidden instructions.
On October 12, Pieter Arntz of Malwarebytes wrote that phishing emails are now baiting AI assistants, giving the example of a fake message from a vendor asking to change payment details, written so that an assistant would treat the change as legitimate.
The attack is a form of prompt injection, in which text from an outside source is treated as an instruction. The risk grows as agents such as Grok Bot, OpenAI's dot and others are given access to read email and take actions such as sending replies or making payments. Polymarket's alert did not say whether any real attacks on agents had been confirmed.
What to expect next
Watch for confirmed cases of agents being tricked by hidden instructions in email, rather than demonstrations by researchers.
Also watch how agent makers respond, for example by stripping hidden text before a model reads it, flagging suspicious instructions or requiring approval for payments and sends. Email providers may also start filtering messages written to manipulate AI readers, and users may need to limit what their agents can do with mail.