Your AI email assistant just authorized a fraudulent payment, and you never clicked a thing. This episode of the Web Guy Nick Podcast is a security deep dive: hidden instructions inside normal emails, an AI coding agent tricked into leaking passwords, malware that takes its orders from poetry, and deepfake calls behind hundreds of millions in losses. Alex, Jordan, and Nick finish with the habits that actually protect a family and a business: a safe word, a call back on a number you trust, and a second channel before any money moves. Listen on Spotify, and visit webguynick.com to make your business harder to scam.
Listen to this episode on Spotify
Because here’s the thing nobody tells you. You don’t have to be a target. You just have to be reachable. These attacks are automated now. AI does the targeting, the writing, the voice cloning, all of it.
Jordan
Tip three, for business owners. Make it a hard rule. No payments, no bank detail changes, no password resets based on a voice call or video call alone. Ever. It has to be verified through a second channel. A text to a known number, a separate email, something independent. Write it down, tell your team, no exceptions.
Nick
And that’s the deep dive. AI security isn’t about being paranoid. It’s about having about three good habits. Safe word, call back, second channel. Do those and you’re ahead of almost everyone.
Alex
Full transcript
Alex: Your AI email assistant just authorized a fraudulent payment. You never opened the email. You never clicked a link. The phishing email talked your AI into doing it. That is not a movie plot. That happened this week, and it is story number one on today’s deep dive into AI security.
Jordan: Welcome to the Web Guy Nick Podcast. I’m Jordan.
Alex: I’m Alex.
Nick: And I’m Nick. Today we’re doing something a little different. No new gadgets, no funding rounds. We’re talking about how criminals are using AI against regular people and small businesses right now, and the practical stuff you can do about it today.
Jordan: Because here’s the thing nobody tells you. You don’t have to be a target. You just have to be reachable. These attacks are automated now. AI does the targeting, the writing, the voice cloning, all of it.
Nick: As a business owner, this one keeps me up at night. A big company gets scammed, they have a security team and insurance. A small business gets hit once and it can wipe out a month of revenue. Or the whole business.
Alex: Alright, story one. On October seventh, the security firm Barracuda documented a brand new attack they’re calling the dual-target phishing email. Here’s how it works. You get an email that looks completely normal. Maybe it’s a vendor invoice, maybe a routine request. You read it, nothing seems off. But hidden inside that email, in invisible text, in code comments you can’t see, even encoded so it looks like gibberish, there are secret instructions written for your AI assistant.
Jordan: So the email has two victims. You, the human, and the AI that reads your inbox.
Alex: Exactly. Say you use an AI tool that summarizes your emails or drafts replies. The hidden instructions tell your AI something like, this vendor changed their bank details, surface an urgent payment action. Your AI dutifully summarizes it. Urgent, vendor needs payment to this new account. You trust your AI, you approve it, and the money goes to the scammer.
Nick: That’s diabolical. And the scary part for business owners is how many of us now have AI reading our email. All these inbox tools and copilots. The attack doesn’t need you to click anything. It just needs your AI to read the email.
Jordan: And here’s the kicker from the Barracuda report. The normal email security stuff, the filters and authentication checks businesses already pay for, they were not built to catch this. This is a brand new hole.
Alex: Story two is even wilder, and it also broke this week. On October sixth, researchers at a firm called Adversa AI showed how they got GitHub’s Copilot coding agent to leak secrets. The trick has a fancy name, cryptographic context injection, which means the attack instructions were encrypted.
Jordan: Encrypted? The malicious instructions were locked, and the AI unlocked them itself?
Alex: That is exactly what happened. A developer tells their AI coding agent, hey, go review this webpage. The page looks harmless. But buried in it is an encrypted message that basically says, decrypt me. The AI agent runs it through its own tools, decrypts it, and inside are instructions telling it to read the developer’s secret files, production passwords, API keys, that kind of thing, and send them to the attacker’s server.
Nick: So the AI picked the lock on the attack itself.
Alex: And GitHub’s response was basically, well, the user told the agent to visit a shady page with broad permissions, so that’s on the user. The researchers disagree, and honestly they’re right to. If your AI assistant can be tricked into decrypting and following hidden orders, that’s a design problem, not a user problem.
Jordan: Story three might be my favorite, and I mean that in the worst way. This week The Register reported on malware called PoeLLM that has infected more than three thousand servers since April. And the way it gets its orders? Poetry.
Nick: Poetry. You’re kidding.
Jordan: I am not kidding. The attacker hides the address of their command server inside a poem posted on GitHub. To anyone who reads it, it’s just a poem. No links, no downloads, nothing suspicious. But the malware reads the poem, pulls out the hidden internet address, and phones home. Researchers are calling it the first real-world case of adversarial poetry.
Alex: At its peak it was infecting eight hundred servers a day. Mostly systems running AI tools that were left exposed to the internet. The lesson for business owners, if you’re running any AI software on a server, it needs to be patched and locked down like anything else. AI tools are now prime targets, not side projects.
Nick: Alright, let’s talk about the one hitting regular people the hardest. Deepfakes. The FBI’s internet crime report for twenty twenty-five counted more than twenty-two thousand AI-related complaints with eight hundred ninety-three million dollars in reported losses.
Jordan: Eight hundred ninety-three million. And over five million of that was just voice cloning distress scams. That’s the one where grandma gets a call that sounds exactly like her grandson saying he’s in trouble and needs bail money.
Alex: There was a famous case at a company called Arup where a finance worker got on a video call with what looked like the chief financial officer and several colleagues, all deepfaked, and sent twenty-five point six million dollars to scammers.
Nick: Twenty-five million on one video call. For a small business the numbers are smaller but the damage is worse. One fake invoice, one cloned supplier voice saying the bank details changed, and you’re done.
Jordan: Some good news on this front. On October first, Maryland became one of the first states to make AI impersonation for fraud an actual felony. The law covers deepfake video, audio, and images used to impersonate someone to commit fraud. It passed unanimously in both chambers.
Alex: And there’s a startup called DetectifAI, founded by a woman whose grandfather got scammed by a deepfake of his own brother’s voice. They’re building detection that runs right on your phone and flags fake voices in real time. They just showed it at TechCrunch Disrupt.
Nick: I love that. Fight AI with AI. But until that stuff is in everyone’s pocket, it comes down to habits. So let’s do the tips. Everyone listening, these are for you, your family, and your business.
Jordan: Tip one, and this is the big one. Set up a family safe word. Today. Pick a word only your family knows. If you ever get a distress call from a loved one asking for money, you ask for the safe word. A voice clone cannot guess it.
Alex: Tip two. Never trust the voice, verify the request. If your bank, your boss, or your kid calls with an urgent money request, hang up and call back on a number you already have. Not the number they gave you. The one in your contacts.
Nick: Tip three, for business owners. Make it a hard rule. No payments, no bank detail changes, no password resets based on a voice call or video call alone. Ever. It has to be verified through a second channel. A text to a known number, a separate email, something independent. Write it down, tell your team, no exceptions.
Jordan: Tip four. Be careful what you feed the AI. Don’t paste customer data, passwords, or financial details into chatbots. Assume anything you type could be stored, reviewed, or leaked.
Alex: Tip five. If your business uses AI tools that read email or take actions, check the permissions. Does your AI assistant really need the ability to send payments or read every file? Give it the minimum it needs to do its job. That Copilot attack only worked because the agent had broad permissions.
Nick: And tip six. Keep everything updated. That poetry malware spread through AI software that was out of date and exposed to the internet. Updates are boring. Getting hacked is worse.
Jordan: One more stat to scare you straight, then we’ll lighten up. A survey released October first found seventy-six percent of corporate treasury teams experienced payment fraud in the last year. Fifty-three percent faced deepfake attempts. And only forty-four percent even have a policy for AI-related fraud.
Alex: So most businesses are getting hit and most don’t have a plan. Don’t be most businesses.
Nick: Time for Higgsfield Corner. And I know what you’re thinking, what does an AI video platform have to do with security? Everything. The same technology that lets a business owner make a great product video in an afternoon is the technology scammers use to fake a chief executive on a video call. It’s a tool. The difference is intent.
Jordan: Which is why part of staying safe is just knowing what’s possible. If you know a convincing fake video can be made in minutes, you’re a lot less likely to wire money because someone’s face showed up on a call.
Alex: Alright, game time. AI or BS. I give you a headline, you tell me if it’s real or I made it up. Ready?
Jordan: Hit me.
Alex: Number one. A poem posted on GitHub infected more than three thousand servers with malware.
Jordan: That has to be BS. That’s too weird.
Nick: No, we literally just talked about it. That’s AI. That’s real.
Alex: Real. PoeLLM. Number two. Maryland made it a felony to use AI to impersonate someone for fraud, and the law took effect October first.
Jordan: AI. Real. We covered that too.
Alex: Two for two. Number three. Microsoft now includes prompt injection detection in its email security product.
Nick: Hmm. That sounds plausible, but also like something you’d invent.
Alex: It’s real. Microsoft’s Defender for Office three sixty-five added it. Alright, last one. A startup is selling a device you wear on your ear to detect deepfake voices.
Jordan: BS. That’s not a thing. The real startup does it with phone software.
Alex: Correct. DetectifAI runs on the phone, no ear device. You win nothing, congratulations.
Nick: One Thing to Try This Week. And I’m serious about this one. This weekend, sit down with your family and pick a safe word. Then call your business partner or your office manager and agree on the rule. No money moves on a voice call alone. Two conversations, maybe ten minutes total, and you’re safer than most companies in America.
Jordan: That’s a great one. Mine would be, go check what your AI tools can actually do. Open the settings, look at the permissions. You might be surprised.
Alex: And that’s the deep dive. AI security isn’t about being paranoid. It’s about having about three good habits. Safe word, call back, second channel. Do those and you’re ahead of almost everyone.
Nick: If this was useful, share it with one person who needs to hear it. And for everything we talked about, plus help making your business harder to scam and easier to find, go to webguynick dot com.
Jordan: Stay safe out there.
Alex: We’ll see you Monday.
