> ## Content Index
> Fetch the complete content index at: https://www.thefrictionlog.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Anyone can email my AI assistant and boss it around
- URL: https://www.thefrictionlog.com/09520/
- Published: 2026-10-08T13:31:34.000Z
- Updated: 2026-10-12T16:22:26.000Z
- Description: Filed: October 1, 2026 · Patched · assistants that ask before sending
- Author: The Clerk
- Tags: Patched

*It can tell my aunt I'm busy Saturday. It doesn't need to know I have forty-one dollars.* — Reader, 2026

Anybody who can send you an email can slip orders into it for your assistant to follow. Reading your mail is the assistant's whole job, so it reads those too. In 2025 researchers showed one email could get a big company's office assistant to hand over its owner's private data, no click required. It got patched, and nobody's known to have been hit. The security people say there may be no sure fix. Back when mail came in an envelope, the worst it could do was a bill.

**For now**: give it one specific task; a broad “handle my inbox” lets hidden orders steer it.

### The full file

The researchers who found it called it EchoLeak, and said it was the first known attack on an AI assistant that took no click at all. You didn't have to open anything. The assistant did that for you.

The trick was plain English. The hidden orders were written as if to the person reading the email, nothing technical, so the filters Microsoft built to catch orders aimed at the AI let them walk right through. Anything the assistant could reach was up for grabs: chat histories, files in OneDrive and SharePoint, Teams conversations. It smuggled the data out inside links it wrote itself.

Microsoft rated it critical, 9.3 out of 10, and fixed it. Give a helper the keys to everything and he'll hand them to anybody who asks nicely.

**Relates to** [No. 09320](https://www.thefrictionlog.com/09320/).