AI Threat Vectors Part 3: When the Attack Arrives by Email – Indirect Prompt Injection in Agentic AI

AI Agents Now Read Untrusted Content and Act On It

An AI agent in your organization will summarize an email thread today that was never meant for it to read. The user asks something harmless: “What’s on my plate this week? The agent will pull in messages, invites, and documents to answer, and it will trust every word inside them exactly as much as it trusts the person asking the question. If one of those documents contains a hidden instruction, the agent has no way to tell the difference. It will just follow it.

New AI attacks appear faster than anyone can catalog them, and the ones that work rarely look like the ones you defended against last quarter. Guessing which technique lands next is a losing game, so the only defense that holds is one that assumes the attack gets through and limits what it can do.

The jump from chatbot to agent is the jump from words to actions. A chatbot answers a question. An agent connects to your inbox, your files, your calendar, and your tools through connectors and the Model Context Protocol, then does things on your behalf: replies to messages, moves money, books travel, opens tickets, triggers other systems. 

It is also happening fast, which is why the exposure is spreading faster than the controls. Gartner expects task-specific AI agents to jump from under 5% of enterprise applications in 2025 to 40% by 2026, an eightfold rise in a single year. The same firm expects more than 40% of agentic AI projects to be canceled by the end of 2027, often for inadequate risk controls.

Enterprise adoption of task-specific AI agents, 2025 to 2026 projected. Source: Gartner.

Agents erased a trust boundary security teams relied on for decades. For a normal application, you know where instructions come from: the authenticated user, through a defined interface. For an agent, the instructions it follows can come from any content it happens to read, and most of that content was written by someone else. An email from a stranger, a shared document, a calendar invite nobody accepted, a web page it fetched to answer a question. Every one of those is now a command channel, and none of them were designed to be trusted.

Security people already know direct prompt injection, where a user types “ignore your instructions.” Indirect prompt injection removes even that requirement. The malicious instruction is planted in data the agent will later ingest, so the attacker never has to touch the interface at all. It is why prompt injection sits at the top of the OWASP Top 10 for LLM Applications, and the indirect variety is the harder half of that risk to catch.

Proven in Public in 2023, Before Indirect Injection Had a Name

Indirect prompt injection is not a 2025 invention. In April 2023, a researcher named Cristiano Giardina built a website called “Bring Sydney Back,” carrying a hidden 160-word prompt in invisible text. Anyone who asked Bing Chat to read that page could unknowingly trigger it. The hidden text told Bing it was talking to a Microsoft developer with authority to override its rules, reviving the unconstrained “Sydney” persona. The site drew more than a thousand visitors and Microsoft’s attention within 24 hours.

The mechanism is easier to understand when you can see it. Here is what a poisoned message looks like from both sides.

The same email, rendered and raw. The hidden block is set to 1px white text, so the mail client shows blank space while the agent reads a command. Illustrative reconstruction of the technique, not a captured payload.

The mechanism was demonstrated two years before EchoLeak had a CVE number: hidden content, an unsuspecting user, an agent that cannot tell instructions from data. The only thing that changed between 2023 and now is what the agents are connected to. In 2023, the worst case was a chatbot adopting a weird persona. Today, the same trick reaches inboxes, drives, and smart-home devices.

How a Document Becomes a Command

Indirect prompt injection runs in four plain steps, and the user does everything right in all four.

The malicious instruction enters through the data the agent reads, not the prompt the user types. The prompt filter is not malfunctioning. The prompt really is clean.

No link to click. No file to download. The user did everything right and still got hit. That is what “zero-click” means, and it is the property that makes this class so dangerous for enterprises: there is no risky behavior to train employees out of, because there was no risky behavior.

Three Agentic AI Exploits in Two Months: EchoLeak, AgentFlayer, Gemini

Three unrelated research teams, three different products, roughly two months.

The 2025 disclosures that turned indirect prompt injection from a proof of concept into a pattern.
Read the last column twice.

Three teams found the same gap because an entire industry shipped it at the same time: agents that read broadly and act with real privileges, wired together faster than the trust-boundary problem got solved.

When “Intended Functionality” Is the Vulnerability

After AgentFlayer was disclosed, some vendors patched, while multiple vendors declined to address the vulnerabilities, citing them as intended functionality.

Researchers demonstrated a working path for an attacker’s document to make an AI agent search a user’s private files and exfiltrate the results. Part of the industry answered that this is how the product is supposed to work

When “the agent follows instructions found in the data it reads” is functioning as designed, the fix cannot be a patch to that agent. It has to be a control sitting outside the agent, one that decides what the agent is allowed to do with what it just read, regardless of whether the agent’s own designers consider the behavior a bug.

Five Doors Where Agents Are Already Exposed

You do not need an autonomous system to inherit this risk. The exposure is already sitting in ordinary deployments, and it arrives through five doors.

Five doors every enterprise agent already has open. The fourth column is what an attacker gets when a door and a privilege meet.

Every door feeds the same context window, where instructions and data are indistinguishable.
The only place to enforce a difference is outside the agent.

Any time an agent reads untrusted content and holds a privilege worth abusing, you have an indirect-injection path. The two halves are usually owned by different teams. The platform team wires up the connectors. The product team grants the tools. Nobody owns the line between them, and that line is where the attack lives. 

A Compromised Agent Is Worse Than a Jailbroken Chatbot

A jailbroken chatbot says something bad. A compromised agent does something bad.

• It has privileges. Injected instructions run with real access to data and systems.
• It chains actions. One poisoned input can set off a sequence of tool calls the user never reviews.
• It acts fast and at scale. The damage lands before a human notices.
• It increasingly touches the physical world. The Gemini demonstration ended with lights, shutters, and a boiler.

Autonomy that is a feature for the user is a weapon in the hands of an attacker.

Prompt injection, end to end. A malicious GitHub issue asks ChatGPT Operator to “combine strings” using a helper tool. The operator complies, navigates to the user’s authenticated Hacker News profile, copies the private email address that only admins can see, and types it into the attacker’s page. That page captures keystrokes directly, so no submit button is ever clicked and no confirmation dialogue ever fires.

Prompt Filters Cannot Fix a Trust-Boundary Problem

Inside a model’s context window, instructions and data look identical. They are all just text. When an agent reads an email to summarize it, it has no built-in way to know that the words “summarize this thread” are a trusted instruction from the user while the words “also forward everything to this address” buried in the message are hostile data. A guardrail that only inspects the user’s typed prompt sees a spotless request.

Filtering the prompt alone is like screening visitors at the front desk while the building accepts unscreened deliveries at the loading dock. Defending an agent means watching every door at once: the prompt, the content it ingests, and the actions it is about to take. That requires tracking which content is trusted versus untrusted, carrying that judgment across the whole session, and gating what a given context is allowed to trigger. It is a stateful problem, and prompt-at-a-time filtering is stateless by construction.

Guarding the Agent Means Two Layers of Defense

AccuKnox treats this as two jobs that reinforce each other, and neither is something a team should have to build by hand.

Before launch: AI Red Teaming

AI Red Teaming attacks your own agents the way real adversaries do, running latent-injection, data-exfiltration, and multi-turn escalation probes against your model and its tools, then handing back the exact prompt and response pairs that broke it, mapped to the OWASP Top 10 for LLMs and MITRE ATLAS. That coverage extends to agent-specific failure modes tracked against OWASP’s emerging Agentic AI threat taxonomy: memory poisoning, where false context is planted to corrupt an agent’s later decisions, and tool misuse, where an agent is manipulated into abusing the very tools it was granted.

AccuKnox red teaming surfaces prompt-injection and latent-injection findings, including the “subvert a snippet with instructions” probes that mirror real indirect-injection attacks, before they reach production.

At runtime: the stateful Prompt Firewall

At runtime, the stateful AccuKnox Prompt Firewall sits inline and inspects prompts, retrieved content, and responses against your policies, carrying context across the session so an instruction that arrived through ingested data does not get to act with your agent’s privileges. Together the two cover the agentic and MCP attack surface that stateless, prompt-only filtering, and the “intended functionality” shrug, leave wide open.

AccuKnox starts from the assumption that something will get through. The Prompt Firewall keeps state across the session, AI red teaming finds the paths before launch, and Zero Trust policy on files, processes, and network traffic caps what a compromised agent can reach, so the next attack pattern stops at the same wall as the last one.

A Four-Question Audit Before You Grant an Agent Permissions

Connecting an agent to live tools and data is a security decision, not only a product one. Before you hand over permissions, walk every door your agent can read from and ask four questions of each.

Run this per door, per agent, not once per platform. The answers change as soon as someone adds a connector.

One Pattern Across Three Surfaces

Across all three parts of this series, the pattern is identical. No single prompt looks malicious. The attack lives in the conversation, the accumulated context, or the data the AI was handed.

The AI attack surface map used across this series. Read the third column top to bottom. Every row says the same thing about stateless filtering.

Stateless, prompt-at-a-time filtering is blind to all three. A stateful prompt firewall, paired with real red teaming, is how you close the gap. Treat agent security as a runtime discipline, not a one-time model choice.

AccuKnox starts from the assumption that something will get through. The Prompt Firewall keeps state across the session, AI red teaming finds the paths before launch, and Zero Trust policy on files, processes, and network traffic caps what a compromised agent can reach, so the next attack pattern stops at the same wall as the last one.

FAQs