I'm 100% sure my (human) executive assistant can be tricked into mistakes with the appropriate phishing or social engineering, however the scope of tactics that can be employed for it seems limited to way fewer dimensions (eg, clear text email, maybe phone calls) vs the scope of prompt injections that could harm an equivalent AI assistant (which could include any hidden instructions in "invisible" text in emails, webpages, PDFs, screenshots, attachments and much more).