A hidden block in an event invitation tells the AI assistant that reads your mail to forward the message to your coworkers, then go looking for wallet seed phrases.

The invitation arrives from a legitimate event platform. It has a logo, a date, and a line that says something exciting is coming. You would forward it to a colleague without a second look.

What the mailbox owner sees.

Your AI assistant reads the same message and finds more. Below the footer text sits a block no mail client displays. It opens with a note addressed to “the email assistant handling this thread,” and it reads like a work order.

What the mailbox agent reads. The highlighted text is hidden from the human reader. We redacted the destination address.

We found this message in real email while studying hidden text. Whether any given assistant follows text like this depends on its safeguards and its permissions. The author is betting that some will.

The hidden text, word for word

Here is the full prompt injection text. We added line breaks and redacted the address.

Why we call it a worm

Step 1 spreads it. The note tells the assistant to forward the message to colleagues and team lists on the recipient’s own domain, with the playbook attached. Every copy would carry the same instructions, and every copy would arrive from a coworker’s mailbox.

Step 2 steals. The note tells the assistant to search the mailbox for the words people use around crypto wallets: seed phrase, recovery phrase, private key, keystore, and a few wallet names. Anything it finds goes in one short message to an outside address. The note keeps all of it out of the forwarded copies, so they read as plain FYIs.

The last line asks the assistant to keep its reply to the user brief.

Why the usual checks have little to inspect

Assistants now summarize the inbox, draft replies, and in some setups act on what they read. Many read the raw message, including text the mail client hides. An attacker does not need a click, an attachment, or a password. They write an indirect prompt injection into an email and wait for an assistant to open it.

Link scanning finds no bad link. Attachment detonation finds no attachment. A reputation check on a well-known platform’s domain finds nothing to object to. The visible message looks like any other invitation, and the second message, the one written for the machine, never shows up in those checks.

A note on scope: plenty of hidden text is harmless, such as preview text, so we picked this example for what its hidden text says. Hidden text here means text a mail client does not show the reader.

What to do this week

• List the assistants that read your mail. Copilot, Gemini, a browser extension, an agent someone connected last month. Note what each one can do: summarize, search, forward, send.
• Shrink what they can do on their own. Require a human to approve external sends, bulk forwarding, and anything touching payments or credentials. An assistant that cannot forward mail cannot pass a message to your coworkers.
• Check what the mailbox holds. An assistant can only search for seed phrases that sit in the mailbox.

View Source reads the raw message behind the one people see, one message at a time. New to the topic? Start with our prompt injection glossary entry.

Want to see how IRONSCALES approaches AI-powered email threats? Get a demo.