Anyone can email my AI assistant and boss it around
It can tell my aunt I'm busy Saturday. It doesn't need to know I have forty-one dollars. — Reader, 2026
Anybody who can send you an email can slip orders into it for your assistant to follow. Reading your mail is the assistant's whole job, so it reads those too. In 2025 researchers showed one email could get a big company's office assistant to hand over its owner's private data, no click required. It got patched, and nobody's known to have been hit. The security people say there may be no sure fix. Back when mail came in an envelope, the worst it could do was a bill.
For now: give it one specific task; a broad “handle my inbox” lets hidden orders steer it.
The full file
The researchers who found it called it EchoLeak, and said it was the first known attack on an AI assistant that took no click at all. You didn't have to open anything. The assistant did that for you.
The trick was plain English. The hidden orders were written as if to the person reading the email, nothing technical, so the filters Microsoft built to catch orders aimed at the AI let them walk right through. Anything the assistant could reach was up for grabs: chat histories, files in OneDrive and SharePoint, Teams conversations. It smuggled the data out inside links it wrote itself.
Microsoft rated it critical, 9.3 out of 10, and fixed it. Give a helper the keys to everything and he'll hand them to anybody who asks nicely.
Relates to No. 09320.
Run into this too?
Know a fix? Leave it for the next person. Any name will do. Every comment is read. A fix that holds up goes on the record. A fix that doesn't is noted, quietly.
Follow to comment Already following? Sign in
Free. One email a week.
Did we get something wrong? It happens. We fix it, note the change, and take it personally. Tell the clerk
Already solved somewhere? Tell us. Every claimed solve is checked before anything changes. We are hard to impress. Report a solve