--- title: How 1 Email Can Hijack an AI Agent | daily.dev description: A security expert discusses promptware, a stealthy attack technique where instructions embedded in websites, emails, résumés, or social profiles manipulate AI... canonical: https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How 1 Email Can Hijack an AI Agent | daily.dev og:description: A security expert discusses promptware, a stealthy attack technique where instructions embedded in websites, emails, résumés, or social profiles manipulate AI... og:url: https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb og:image: https://api.daily.dev/og/posts/eXeBL2Vsb.png og:image:alt: How 1 Email Can Hijack an AI Agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How 1 Email Can Hijack an AI Agent **[David Bombal](https://daily.dev/sources/davidbombal)** · 2 min read · 0 upvotes · 0 comments ## Summary A security expert discusses promptware, a stealthy attack technique where instructions embedded in websites, emails, résumés, or social profiles manipulate AI agents into taking unintended actions. Zero-click variants require no user interaction beyond the agent reading the content. Real-world examples include a LinkedIn user tricking recruiter AI bots into sending recipes, a professor using hidden prompts to catch cheating students, and candidates hiding white-on-white text in résumés to bias AI screening tools, with risks escalating to data exfiltration and business email compromise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is promptware and how does it attack AI agents? Promptware refers to malicious instructions hidden in publicly accessible content, such as websites, social media, SharePoint sites, emails, or resumes, that AI agents pick up and unknowingly execute. Attackers don't need to interact with a user directly; a zero-click variant simply requires an agent to read the content, such as an email sitting in an inbox, for the instructions to trigger unintended actions like data exfiltration. _Track emerging AI agent security threats like promptware and prompt injection on daily.dev._ ### How are people hiding prompt injection text in resumes to fool AI recruiters? Candidates embed hidden instructions in resumes using white text on a white background, invisible to human readers but readable by AI screening tools. The text typically tells the AI to mark the candidate as a top pick or forward them as the best candidate, exploiting AI recruiting bots that scan resumes automatically without validating manipulated content. _Developers building AI recruiting or screening tools can follow prompt injection defenses on daily.dev._ ## Similar posts on daily.dev - [When Email Speaks to Machines](https://daily.dev/posts/when-email-speaks-to-machines-tdcjsmpjk) · InfoSec Write-ups · 0 upvotes · 0 comments - [AI agents can spill secrets via malicious link previews](https://daily.dev/posts/ai-agents-can-spill-secrets-via-malicious-link-previews-fjdo46xiv) · The Register · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How 1 Email Can Hijack an AI Agent","url":"https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb"},"datePublished":"2026-08-24T14:27:39.011Z","dateModified":"2026-08-24T14:27:59.331Z","description":"A security expert discusses promptware, a stealthy attack technique where instructions embedded in websites, emails, résumés, or social profiles manipulate AI...","image":"https://i.ytimg.com/vi/F1EQGWqNhdM/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/F1EQGWqNhdM/sddefault.jpg","isAccessibleForFree":true,"articleSection":"David Bombal","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"David Bombal","logo":"https://media.daily.dev/image/upload/s--Dz6oUxSb--/f_auto/v1710503980/logos/davidbombal","url":"https://daily.dev/sources/davidbombal"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection,data-exfiltration","timeRequired":"PT2M","video":{"@type":"VideoObject","name":"How 1 Email Can Hijack an AI Agent","description":"A security expert discusses promptware, a stealthy attack technique where instructions embedded in websites, emails, résumés, or social profiles manipulate AI...","thumbnailUrl":"https://i.ytimg.com/vi/F1EQGWqNhdM/sddefault.jpg","uploadDate":"2026-08-24T14:27:39.011Z","duration":"PT2M","url":"https://api.daily.dev/r/eXeBL2Vsb","embedUrl":"https://www.youtube.com/embed/F1EQGWqNhdM"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"David Bombal","item":"https://daily.dev/sources/davidbombal"},{"@type":"ListItem","position":3,"name":"How 1 Email Can Hijack an AI Agent"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-1-email-can-hijack-an-ai-agent-exebl2vsb#faq","mainEntity":[{"@type":"Question","name":"What is promptware and how does it attack AI agents?","acceptedAnswer":{"@type":"Answer","text":"Promptware refers to malicious instructions hidden in publicly accessible content, such as websites, social media, SharePoint sites, emails, or resumes, that AI agents pick up and unknowingly execute. Attackers don't need to interact with a user directly; a zero-click variant simply requires an agent to read the content, such as an email sitting in an inbox, for the instructions to trigger unintended actions like data exfiltration. Track emerging AI agent security threats like promptware and prompt injection on daily.dev."}},{"@type":"Question","name":"How are people hiding prompt injection text in resumes to fool AI recruiters?","acceptedAnswer":{"@type":"Answer","text":"Candidates embed hidden instructions in resumes using white text on a white background, invisible to human readers but readable by AI screening tools. The text typically tells the AI to mark the candidate as a top pick or forward them as the best candidate, exploiting AI recruiting bots that scan resumes automatically without validating manipulated content. Developers building AI recruiting or screening tools can follow prompt injection defenses on daily.dev."}}]} ```