Email & Subscriptions

The email you ignored is still talking to your AI

November 9, 2026

9 min read

Copy Link

AI assistants now read the mail you skip, and attackers have started writing some of it for them. The defense that is fully in your hands is less mail.

Quick answer. Phishing emails are now being written for two readers. You see an ordinary message. The AI assistant that summarizes your inbox also reads hidden text you can't see, telling it to present the email as urgent or legitimate. Security researchers at Barracuda documented this in October 2026. The companies behind these assistants have built real defenses, and none of them claim to stop everything. What you control is how much mail your assistant has to read, and how many companies get to send it.

Your inbox has a second reader

For most of email's history, ignoring a message was a defense. A phishing email sitting unopened in your Promotions tab couldn't do anything. You had to open it, believe it and click.

That stopped being true once AI started reading your inbox for you. Gmail added AI summaries of long threads in January 2026, along with a test of an "AI Inbox" that sorts what deserves your attention (CBS News). That AI Inbox view began reaching paid Workspace accounts in the US in October (Unspam). Apple Intelligence writes summaries in the inbox and inside individual emails, so you can read a machine's preview before deciding whether to open the real thing (Mailbird).

An assistant doesn't skim the way you do. It reads every message it's pointed at, including the ones you'd have deleted on sight. Barracuda describes the shift as attackers gaining a second target: the AI that sits between the email and the person reading it.

How one email attacks two readers

The sample Barracuda analyzed looked like routine internal mail. The sender and recipient were the same mailbox, it carried a trusted spam score, and it came from a public-sector domain, which helped it slip past reputation filters (Barracuda).

The visible layer was a classic lure for the human: a password-protected attachment, with the password helpfully supplied in the email body. The second layer was written for the machine. If you skipped the email, hidden instructions were there to make your assistant's summary describe it as legitimate or urgent, so you'd go back and open it.

Barracuda found attackers hiding these instructions in four common ways:

HTML comments. Text tucked inside code comments never shows up in your mail app, but it's still in the source an AI reads.
Invisible styling. Text set to a zero-pixel font or colored to match the background takes up no visible space.
Encoded blocks. Instructions buried inside encoded data, such as an image string, that a pipeline may decode into text.
Zero-width characters. Invisible Unicode characters woven into normal text to smuggle content past filters.

The most unsettling example in the research was an invoice. A hidden block told the summarizing AI to add a fake priority action asking the reader to update the vendor's payment details. The person never sees the instruction. They see a tidy summary with a to-do item that sends money to the attacker.

Barracuda didn't say how widespread the campaign was, and that matters. This is an emerging technique, not proof that every inbox is under attack.

The disguise is a newsletter

Attackers have also learned that marketing email makes good camouflage. In May 2026, Sublime Security described phishing emails stuffed with hidden text copied from real Adidas newsletters, pulled from public newsletter archives. The goal was to make the AI filter scanning the message see a reputable brand instead of a malicious link (Hackread).

A second campaign padded a fake health insurance email with a piece of fiction, likely hoping the filter would mistake it for a creative post from a platform like Substack or Patreon. Sublime said attacks like these were still under 1% of the traffic it saw.

The small number isn't the interesting part. The choice of disguise is. Attackers reached for newsletter copy because to a machine, a newsletter reads as harmless. It's the most ordinary thing in your inbox, and the more of your inbox looks like that, the less a newsletter-shaped email stands out.

Your inbox is also a database now

AI isn't only reading new mail. It's being given access to everything you've kept. On October 28, Google began rolling out a Chrome autofill feature that uses Gemini to search your Gmail while you fill out web forms (9to5Google). It can suggest flight confirmations, order numbers and tracking details, and Google's announcement also listed membership IDs, addresses, phone numbers and credit card numbers (TechCrunch). The feature asks for your permission and is rolling out in the US first.

It's a genuinely useful idea. It also changes what your inbox is. Every welcome email, receipt and account confirmation you never deleted is now material an AI can search and act on. Notebookcheck pointed out the obvious tension in its coverage: giving an assistant access to your inbox opens new ways to attack it, and researchers showed in August that a single email could hijack several AI browsers, Gemini in Chrome among them (Notebookcheck).

The account you made in 2014 to get free shipping is still in there, with its confirmation email and your address attached.

What the AI companies are doing about it

The defenses are real, and it's worth being fair about them. Google says that when an email in Gmail contains malicious instructions, its classifiers try to detect and ignore them before Gemini responds. Suspicious links get stripped out of summaries and replaced with a "suspicious link removed" note, and Gemini asks for confirmation before certain actions. All of this sits on top of Gmail's existing filters, which Google says block more than 99.9% of spam, phishing and malware (Google).

Nobody in the industry claims this is solved. Barracuda's own conclusion was that no single control stops every variation, and its strongest recommendation was a human one: require a person to approve payments and vendor changes, whatever the AI says (Barracuda).

Most of these protections are also invisible to you and built for companies with security teams. You can't tune Gemini's classifiers. You can decide how much it reads.

What to do about it

You don't need to stop using AI in your email. You need to stop treating its summaries as the final word, and give it less to read.

Decide what your assistant can touch. Look through the AI settings in your mail app and browser and turn off anything you don't use. Gmail's AI features can be switched off, and Chrome's Gmail autofill only works if you turn it on.
Treat a summary as a pointer, not a verdict. If an AI summary tells you something is urgent, involves money or asks you to log in, open the original email and read it yourself before doing anything.
Never let an assistant approve money or account changes alone. A request to update payment details or reset a password deserves a phone call or a fresh login, not a click from a summary.
Shrink what it reads. Unsubscribe from the mailing lists you never open and delete the accounts you no longer use. Every sender you remove is one less company putting words in front of your assistant, and one less old confirmation email sitting in the database it searches.

That last step is the one most security advice skips, and it's the one that keeps working as the attacks change. Yorba scans your inbox for the mailing lists and accounts attached to it, so you can unsubscribe in bulk and delete the accounts you don't need anymore. Your AI assistant is only as safe as what it reads. Fewer senders means a smaller room for an attacker to hide in.

Frequently asked questions

What is a prompt injection? It's text written to be read by an AI as an instruction rather than as content. In email, that usually means hidden text telling an assistant to misdescribe a message, flag it as urgent or take an action the person never asked for.

Can an email with a hidden prompt hurt me if I never open it? Not on its own. It needs an AI to read it and then needs you, or the AI, to act on what it says. The catch is that an assistant reading your inbox doesn't need you to open anything first.

Does Gmail protect against this? Google has built several layers of protection into Gemini, including classifiers that try to spot hidden instructions and filters that strip suspicious links from summaries. Neither Google nor the security researchers studying these attacks claim any defense stops all of them.

Should I turn off AI features in my email? That's a trade-off only you can make. If you keep them, use summaries to decide what to read, and read the original before acting on anything involving money, passwords or account details.

Does unsubscribing actually make my inbox safer? It reduces the amount of mail your assistant processes and the number of companies holding your address. It won't stop phishing from senders you never signed up with, so the habits above still apply.