Hidden Instructions in Fake Invoices Target AI Email Agents
Invoice fraud now includes prompt injection aimed at email-reading agents — external messages must not become executable instructions.
Short answer
Prompt injection hides commands in emails, documents, and web pages an AI reads — a reported invoice campaign tried to make an agent forward forged payment requests. Treat untrusted content as data not authority, limit agent permissions, verify payments independently, and test assistants against hidden-instruction attacks.
A fraudulent invoice is an old business problem. What changes when the person reading it is not a person at all, but an artificial intelligence assistant with permission to forward messages, prepare accounts records, or begin payment workflows?
On 26 October 2026, email security company Sublime Security described an invoice-fraud campaign it had detected several days earlier. The messages impersonated business leaders and suppliers, included forged invoices for approximately US$88,000, and attempted to create urgency around a supposed discount for prompt payment.
The unusual detail was a second message hidden inside the email. Attackers used invisible characters and carefully formatted webpage code to place instructions intended for an AI assistant rather than the human recipient. The hidden instruction sought to make an email-reading agent forward the forged invoice to an accounts-payable address.
This technique is called prompt injection: placing instructions in material the AI is meant to read as information, hoping that the system will treat them as commands. Sublime reported mixed responses when it tested the hidden material against different models. Some ignored it; others exposed or recognised it as suspicious.
The campaign shows an attempted attack, not a confirmed successful payment or agent takeover. The security company has not established that any targeted organisation paid the invoice because an AI assistant followed the instruction.
Why this matters
For years, companies have taught staff to look for suspicious emails and independently verify changes to payment instructions. AI creates a new route around those precautions. An employee may see only a normal-looking message, while an automated assistant processes extra information hidden from view.
If the assistant is allowed to forward documents, create suppliers, or prepare transactions without scrutiny, a fraudulent message can influence the business workflow before anyone has considered whether the underlying request is genuine.
This risk is not restricted to email. Similar instructions can be concealed in websites, attached documents, and information retrieved by AI research tools.
What to do
Treat messages as information, not authority. An outside email should never be able to change an AI agent's operating instructions.
Limit permissions. Allow assistants to read or prepare drafts where appropriate, but require authorised human approval for payments, supplier changes, and external commitments.
Verify requests independently. Check payment details and unusual instructions through a known contact channel, not merely by replying to the suspicious message.
Test the awkward cases. Include hidden text, fabricated conversation histories, and misleading attachments when assessing AI email assistants.
Sources
- Sublime Security, 26 October 2026 — invoice fraud and prompt injection.
- Sublime Security, 21 October 2026 — enabling inbox agents safely.
- ISO/IEC 42001 explained — International Organization for Standardization.
We define what agents may read versus execute, with permission limits, logs, and attack testing — through AIMS implementation and gap assessment.