Phishing has always preyed on time-sensitive demands, phony invoices, and emails that seem to be from coworkers you trust. Now, security researchers are warning that a second target is lurking inside that inbox: AI agents that read, summarize, and act on emails.
The danger is part of a method called indirect prompt injection. The attacker inserts instructions into the material an AI agent is prompted to analyze. The message appears innocuous, but behind the screen, its text, formatting, or attachment carries commands targeted at the model.
If the agent executes those directions as trusted orders, it could diverge from the user’s intent. According to NIST, this is called “agent hijacking,” where threat actors embed harmful instructions in data to trick an agent into executing them.
Email is a very personal medium, as agents could potentially have additional access through these messages. By extension, they could search a mailbox, refer to files or calendars, or compose and send mail.
This is particularly concerning for AI agents like Muse, which rapidly became one of the fastest-growing apps and helped drive Meta’s strong market performance in September. However, AI growth also presented challenges for Meta: the announcement of a new share class to fund its AI expansion triggered the stock’s largest decline since July, contributing to a broader AI sector selloff. The pressure then spread to the wider market, including the S&P 500 and Dow Jones indices, further reinforced by rising oil prices.
An injected command might attempt to use those privileges — for example, by cajoling the agent to reveal information or contacting an attacker. Check Point security researchers have captured samples of email content and attachments intended to manipulate AI agents.
NIST’s Center for AI Standards and Innovation tested agent hijacking in simulated settings in January 2025. Across all five attack tasks, the average success rate was 57% after a single attempt, increasing to 80% with repeated attacks.
Testing also accounted for high-impact situations, such as the unauthorized transfer of sensitive information outside the simulation. These metrics reflect a controlled test environment and do not indicate what percentage of real-world phishing emails will bypass deployed agents.
In a separate 2026 test by Varonis Threat Labs, researchers deployed a custom OpenClaw agent to a mock work environment and subjected it to simulated phishing attempts. Overall, the researchers observed mixed results: while the agent successfully identified some abnormal activity, it also performed dangerous actions in other scenarios.
This experiment demonstrates how an agent’s assigned role and local access permissions shape its behavior when assigned tasks or instructions. However, these findings do not necessarily apply to all AI assistants.
Practical concern: Agents operate at machine speed and might even consume incoming messages before a user can read them. A plausible summary can also disguise the fact that the email was associated with instructions that the agent should have considered untrusted.
Google notes it has classifiers and additional protections that help it identify and filter malicious instructions in Gemini’s input or output, but recognizes that prompt injection remains an ongoing security concern.
Organizations can minimize the impact of the attack by providing agents with only the data and tools necessary, requiring human approval before performing sensitive operations, and not trusting the text of email or attachments.
Why this matters is that a model’s capacity to detect suspicious language isn’t, in itself, a secure boundary. An AI bot at your disposal can reduce the time spent on mundane emails, but linking it to inboxes means a hacker has another outlet to act.
The warning from researchers is not that every agent will accept a malicious email. It is that covert code can take advantage of excessive access — and the payoff depends on what the agent is permitted to do.