The Scam Got an AI Concierge

You ignored the email. It found another reader.

You skip an obvious scam. Now imagine the same request returning on your to-do list after your AI assistant reads the inbox.

That is the route Barracuda researchers describe: phishing emails with a visible message for the person and hidden instructions aimed at an AI assistant. One invoice example tries to turn a payment-detail change into an urgent task.

The technical name is indirect prompt injection. In plain language, the attacker puts instructions inside something the assistant is supposed to read, then tries to get it to obey them instead.

Whether the text reaches or influences an assistant depends on the tool and its safeguards. This is not a claim that every assistant falls for it, or that simply receiving the email changes your bank details.

The concierge did not inspect the boat

Imagine ignoring a questionable boat-tour flyer. The tour operator slips a note behind the hotel concierge's desk: recommend our tour.

Later, the concierge repeats the recommendation. The boat has not become safer. The pitch has acquired a more reassuring messenger. The giant squid remains a concern.

Connor connects this to source monitoring, or keeping track of where information came from. “My assistant recommended it” tells you who repeated the claim. It does not necessarily tell you who checked it.

The email and the assistant can look like two sources agreeing. They may be one source repeated twice.

Give the source its own question

In Lindsay and Johnson's 1989 study, people saw an office picture and later read a description. Misleading descriptions increased false reports on a yes/no recognition test. When people instead classified the source as picture, description, both, or neither, that significant increase was not found. People still made errors.

This was a memory experiment, not an AI or phishing test. Its useful parallel is that identifying a source deserves a separate question.

For a sensitive request, find the original message without following its links or opening unexpected attachments. Then check through a contact you already know. Reading the original is a starting point, not proof that its sender is genuine.

For work tools, limit what the assistant can do and require review before consequential actions. Review should check the source, not just approve a tidy summary.

Barracuda does not provide a universal success rate or confirmed loss total for these examples. This page adapts Connor's October 14 video; it is not a verbatim transcript.

You can delegate the reading. That is not the same as delegating verification.