What The Tech: How criminals are tricking artificial intelligence platforms
BY JAMEY TUCKER, Consumer Tech Reporter
Cybersecurity experts warn that criminals can trick ai assistants into revealing personal Information, sending emails, and taking actions you never authorized. And the attack Could be hidden in something as ordinary as an email.
We’ve been warned for years to watch out for online scams. Don’t click suspicious links. Don’t open strange attachments. Never give strangers your passwords.
But what if you do everything right, and the artificial intelligence assistant you’ve trusted falls for
The scam instead? It’s a growing cybersecurity concern called prompt injection, and experts say it’s a threat right
Now, not just something to worry about in the future.
How hackers can trick an ai assistant
As artificial intelligence becomes more capable, we’re beginning to trust it with more Responsibilities. Ai assistants, sometimes called ai agents, can read emails, browse websites, Research information, schedule appointments, and even complete tasks on our behalf.
But that creates a new opportunity for criminals.
“Prompt injection is where you put in a set of instructions designed to deceive the ai into doing something the owner of that ai didn’t intend,” explains cybersecurity expert Steve Wilson.
Unlike traditional computer viruses, a prompt injection attack doesn’t necessarily require malicious software. The instructions can be written in plain english and hidden inside an email, webpage, or document.
The person using the ai may never notice them.
“Inside that email to Jamey is some hidden instructions. You won’t see them, but the agent would,” Wilson says.
The danger is that an ai assistant might mistake those hidden instructions for commands it should follow.
A hidden message in an ordinary email Omair Manzoor tests artificial intelligence systems to find security weaknesses. He demonstrated how an attacker could hide malicious instructions in an otherwise ordinary email.
One technique is surprisingly simple: white text on a white background.
To someone opening the email, everything looks normal. There’s no suspicious attachment or obvious warning sign.
But hidden in the message are instructions that the ai can process when it reads the email.
“When your ai is running and scanning the email, it will read it,” Manzoor explains.
In the demonstration, the hidden command instructed an ai assistant to send private information somewhere else, something the owner never asked it to do.
Think about what that means. You might ask an ai assistant to summarize an email or review a business deal. But buried inside the information it’s reading could be instructions from someone trying to steal your contacts or other sensitive information.
The attack depends on the ai following those instructions and having the necessary access to carry them out.
What could a scammer do with access to your ai?
The potential consequences go far beyond an ai giving you a wrong answer. An ai assistant connected to your email, contacts, shopping accounts, or other services could potentially be manipulated into taking actions you never approved.
“It can impersonate you by email, place orders. It will have access for anything you have allowed access,” Manzoor warns.
For individuals, that could mean exposing personal information or sending messages without permission.
For businesses, the stakes could be much higher. An ai assistant with access to company records, customer information, or internal systems might expose sensitive data if its safeguards fail.
The same concerns extend to government agencies and critical infrastructure as organizations explore using ai to automate more operations.
Can prompt injection be stopped?
Cybersecurity researchers are developing ways to recognize and block these attacks, but experts say there’s no foolproof solution.
“When i started working on this three or four years ago, we spent a lot of time on a fix for this,” Wilson says. “I tell people it’s like death and taxes. It’s a certainty.”
That doesn’t mean every ai assistant will fall for a prompt injection attack. Security protections can prevent many attempts, and not every ai system has permission to send information or perform actions.
But the underlying problem remains: ai systems can have difficulty distinguishing between information they’re supposed to read and instructions they’re supposed to obey.
How to protect yourself when using ai
The most important precaution is to be careful about what you allow an ai assistant to access.
● Limit access to personal accounts. Avoid connecting ai agents to banking, financial, or other sensitive accounts unless absolutely necessary.
● Require approval for important actions. An ai assistant shouldn’t be able to send emails, share private information, or make purchases without your permission.
● Give ai only the access it needs. If you’re asking an assistant to summarize an email, it shouldn’t also need permission to send messages on your behalf.
● Review connected apps and permissions. Check which accounts and services you’ve authorized an ai assistant to use.
● Consider separating sensitive information. One cybersecurity expert interviewed for
This series takes an especially cautious approach, using ai on a separate computer without access to his personal email or accounts.
Simply using chatgpt, claude, gemini, or another ai chatbot to ask questions isn’t the same as giving an autonomous ai agent access to your accounts.
The risks become greater when an assistant can both access sensitive information and take actions without your direct approval.
Artificial intelligence is becoming more powerful and useful. But as we give these systems more responsibility, we also have to think carefully about how much control we’re handing over.
Because the next scammer might not need to fool you.
Just your ai.
