Threat
Invoice fraud campaign adds prompt injection aimed at email AI agents · Blog
Publication date unknown · Discovered sublime.security
Page published
Publication date unknown · First observed: 4 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The reported invoice-fraud campaign highlights inbound email as an attacker-controlled prompt-injection surface for agents processing potentially fraudulent payment requests.
Sublime Security reports an invoice-fraud campaign adding prompt injection aimed at email AI agents. The supplied excerpt is truncated and does not include attack payloads or evidence of successful agent compromise.