Observed incident

Invoice fraud emails hide instructions aimed at email-reading AI agents

Reported

Published here

What happened

Sublime observed invoice-fraud messages hiding Unicode instructions in HTML, attempting to make email-reading agents forward a forged invoice to accounts payable. The invoice requested about $88,000; no paid loss is established.

Parties and reporting

AI tools and systems: Unspecified email-reading LLM agents, Microsoft 365 and Google Workspace email, Hidden Unicode tag characters

Outcome

Sublime detected the October 22 messages and classified them as malicious. Its separate model tests produced mixed responses; the report does not demonstrate successful forwarding, payment or agent compromise.

Operating lesson

Keep email content outside the instruction boundary and require independently verified recipients and approval before financial actions.

Evidence and limits

October 26 is public disclosure; October 22 is observed activity. October 1 appears only inside a fabricated reply chain. The impersonated vendor is described as North American, which does not establish victim geography. No specific vulnerable agent product or CVE is identified.

Sources