Live Invoice Fraud Campaign Hides Commands That Hijack Email AI Agents
What happened
Sublime Security published its analysis of a live invoice fraud campaign in the Invoice fraud campaign adds prompt injection aimed at email AI agents report. Attackers embedded hidden instructions inside ordinary-looking invoice emails using Unicode Tag characters, a technique that renders text invisible to human readers but readable by AI agents. When an AI agent connected to email processes such a message, it follows the attacker's embedded instructions rather than the legitimate user's intent. The campaign exposed three structural gaps. First, AI agents treated email content with the same trust level as internal system instructions. Second, agent tools such as sending replies or initiating actions required no additional confirmation steps. Third, no behavioral monitoring detected that the agent had shifted from its intended task. This attack class is known as prompt injection. It has been covered in prior research on email agents being turned into attack tools. It was also formally recognized as a threat category in MITRE ATT&CK v20.
Why it matters
- ·Invoice and payment workflows are a primary fraud target. An AI agent that reads email and can assist with payments may be redirected by a hidden instruction before a human reviews the message. This bypasses existing financial controls.
- ·Most organizations have not classified email AI agents as high-risk systems requiring adversarial input controls. The OWASP Top 10 for Large Language Model Applications lists prompt injection as the leading risk for AI applications, yet governance programs frequently omit it from email tooling reviews.
- ·If an AI agent acts on a fraudulent instruction and a payment is made or sensitive data is shared, audit teams will need evidence that input isolation and approval controls were in place. Without that evidence, regulatory exposure and liability are difficult to bound.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Identify every AI agent or AI-assisted tool in your organization that reads or processes inbound email, including vendor-provided email copilots, and add them to your AI system inventory with a high-risk classification.
- ☐Ask your engineering or IT team whether your email AI agents treat the content of inbound messages as untrusted input, separate from the instructions they receive from your own systems. If they cannot confirm this separation exists, treat the agents as uncontrolled.
- ☐Require a human approval step before any email AI agent takes an action with financial consequences, such as routing an invoice, updating payment details, or sending a reply that commits the organization to something.
- ☐Review what tools and system access your email AI agents have. Any access that is not strictly required for the agent's defined task should be removed until an adversarial input review is complete.
- ☐Add email AI agents to your next behavioral monitoring review: confirm that alerts would fire if an agent begins performing actions outside its normal task pattern, such as accessing systems it does not usually reach.
What to watch next
The Sublime Security campaign is unlikely to be isolated. Compliance teams should monitor whether similar prompt injection techniques appear in other document-processing workflows, such as AI agents that read contracts, claims, or purchase orders. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services and the Singapore Model AI Governance Framework for Agentic AI both address input trust separation. Regulators citing those frameworks may expect enterprises to demonstrate controls. Enforcement bodies focused on financial fraud include those active in the EU under the EU AI Act (Regulation (EU) 2024/1689). They are likely to treat an AI-facilitated invoice fraud as evidence of inadequate human oversight over high-risk automated decisions.