AI Email Assistants for Small Business, and the Phishing Trick Aimed at Them

Email is the job nobody hired you for. An AI email assistant can take a real slice of it. In October 2026, the email security company Barracuda reported scammers writing emails aimed at the assistant itself. Here is how to pick one, set it up, and keep it from being turned against you.

What an AI Email Assistant Actually Does

• Triage: sorting new mail into "needs me today" and "can wait."
• Reply drafting: a first draft of the quote follow-up, for you to edit.
• Follow-up reminders: spotting who is still waiting on you.
• Thread summaries: a long back-and-forth in five lines.

In our experience, drafts and summaries pay off on day one; triage needs a week or two of corrections.

Start With the One You Already Pay For

If you run on Microsoft 365 or Google Workspace, start there: it already sits inside your mail, under an account you control. On Microsoft 365, Copilot Chat can summarize Outlook threads without the $21 license. A dedicated assistant earns its price when the inbox is the job. One catch: on Free, Go, Plus and Pro ChatGPT plans, OpenAI may train its AI on what it reads in connected apps. Turn off "Improve the model for everyone" to stop that. More in what happens to data you paste into AI chats.

A Realistic First Week

Before day 1, time one morning's inbox. Check early summaries against the real emails. On day 5, teach it what matters: in Outlook, go to Settings, then Copilot, then Prioritize, and add a rule such as "It's about a customer complaint." In Gmail, click any wrong importance marker; Gmail learns from that. Time it again; keep it only if the time saved is worth the price.

Prompt Injection: The Phishing Trick Aimed at Your Assistant

Prompt injection means hiding instructions inside something the AI reads, so it follows the attacker instead of you. Barracuda describes emails written for two readers: you see ordinary-looking business mail; your assistant also reads instructions hidden in four ways:

• Notes in the email's code your mail app never shows.
• Invisible text, such as a zero-size font or white lettering.
• Instructions buried in encoded data, such as an image's data string.
• Invisible characters mixed into normal text.

In Barracuda's invoice example, hidden text tells the AI to add an urgent to-do to its summary: update the vendor's payment details. The summary nudges you to pay the attacker. Hidden text can also flag a phishing email as urgent. Security guidance from the OWASP Gen AI Security Project says it is unclear whether any fool-proof prevention exists. So the fix is a habit you control, not a setting you buy.

Three Checks Before You Turn It On

1. Keep it read-only for anything involving money. It summarizes and drafts; it never pays, edits a vendor record, or emails someone new without you. Claude's Gmail connector asks before every send by default. ChatGPT lets you choose, and OpenAI says "Allow all actions" carries elevated risk, so keep "Always ask."

2. Verify bank-detail changes by phone, on a number you already have, never one from the email. It is the call-back habit from our small business security baseline, and it works because the fake request lives only in the email.

3. Buying Copilot through an IT provider on or after December 1? Ask about the limit. New Copilot Business licenses will then have pay-per-use billing on by default: extras bill in Copilot Credits on top of the license price, up to 4,000 credits per user per month unless admins change it. Eleven countries, including Australia, France and Germany, are excluded at first.

The Bottom Line

An AI email assistant is an easy win, as long as it reads and drafts while you decide. Start with the one you already pay for, give it a read-only week, and put a phone call between any email and any change to where money goes. Want it chosen and configured for you? That is our AI tool setup service.

Sources

1. Barracuda, "Threat Spotlight: Email attacks target both humans and AI in the same message" (October 2026): hidden instructions and invoice example. blog.barracuda.com
2. Microsoft Partner Center, "October 2026 announcements" (October 2026): December 1 changes. learn.microsoft.com
3. Microsoft, "Microsoft Copilot for Business" (October 2026): Copilot Business pricing. microsoft.com
4. Microsoft message center, "Microsoft Outlook: Copilot chat now available to summarize emails for more users" (MC1124564, 2025). mc.merill.net
5. Microsoft Learn, "Catch up on email in Outlook" (July 2026). learn.microsoft.com
6. Microsoft Support, "Prioritize my inbox" (accessed October 2026). support.microsoft.com
7. Google Workspace, "Compare Flexible Pricing Plan Options" (October 2026): Gemini in Gmail, Starter price. workspace.google.com
8. Gmail Help, "Importance markers in Gmail" (accessed October 2026). support.google.com
9. Claude Help Center, "Use Google Workspace connectors" (October 2026): availability and send approval. support.claude.com
10. OpenAI Help Center, "Connected apps in ChatGPT" (October 2026): permissions and training. help.openai.com
11. OpenAI Help Center, "ChatGPT release notes" (June 2026): Gmail sending plans. help.openai.com
12. Fyxer, "Pricing" (October 2026): Pro plan. fyxer.com
13. OWASP Gen AI Security Project, "LLM01:2025 Prompt Injection" (2025). genai.owasp.org