Barracuda Research (Guruprasad Kenja) describes phishing emails with two layers. The visible layer is ordinary phishing, in its sample a password-protected attachment with the password in the body. A hidden layer tells AI email assistants to present the message as legitimate or urgent, and in an invoice example it tells the summarizing model to add a fake priority action: change a supplier's bank details. The four hiding spots it saw most were HTML comments, CSS-invisible text (zero-size or white font), Base64 blocks such as image data strings, and zero-width Unicode characters. Its sample looked internal, with the same From and To mailbox, a public-sector sending domain and a trusted spam score. Barracuda didn't say how many such emails it has seen, and it sells email security. Defenses it lists: strip hidden content before the AI sees it, sandbox what the assistant can do, check outputs before they trigger actions, and require a human for payments and vendor changes. Malwarebytes adds that whether hidden content reaches the model depends on how each tool extracts the email.