Your inbox is the attacker’s input field
Prompt injection through email and calendar invites
An assistant that reads your email reads what strangers send you. That single fact is why the most consequential prompt-injection incidents of 2025 arrived as ordinary messages and meeting invitations, needed no click, and were fixed by vendors rather than by users. This guide explains why email is the ideal carrier, what the documented attacks did, what has changed since, and what you can still do yourself.
Why email is the ideal carrier
Anyone can send you an email, and an assistant connected to your mailbox will read it without asking. Assistants summarise threads, draft replies, search for facts and, increasingly, act: they file, forward, schedule and respond. To find what to read they use retrieval, which ranks messages by relevance to the question you asked. An attacker therefore controls two things: the text the model will read, and, by writing it to match the questions you are likely to ask, the moment it will be read. Nothing about the message needs to look suspicious to you, because you were never meant to read it.
The same is true of a calendar invitation or a shared document. Each is text an outsider wrote, delivered into a system that treats it as part of your world. Simon Willison’s description of the lethal trifecta applies exactly: private data in the mailbox, untrusted content arriving in it, and an assistant able to send messages out of it.
EchoLeak: a zero-click leak from an enterprise assistant
In January 2025 researchers at Aim Labs reported to Microsoft that a single email could make Microsoft 365 Copilot leak internal data. The message carried instructions written as if addressed to a human reader, which let it pass the classifier meant to catch injection. When the recipient later asked Copilot an unrelated business question, retrieval judged the email relevant and handed it to the model, which followed the instructions, gathered sensitive content and embedded it in a Markdown image whose URL relayed the data outward through Microsoft’s own trusted domains. The user did nothing except receive an email and use Copilot as intended.
Microsoft fixed the chain server-side in May 2025, assigned it CVE-2025-32711 and said no customers had been affected; Aim Labs published in June, describing it as the first known zero-click vulnerability in an AI assistant. Every stage of it, the phrasing that evaded the classifier, the retrieval that surfaced the message, the rendering that provided the exit, has a lesson, and none of the lessons is about the user being careless.
Calendar invitations and shared documents: promptware
In August 2025 Ben Nassi, Stav Cohen and Or Yair published “Invitation Is All You Need”, a study of what they called promptware: prompts engineered to compromise the confidentiality, integrity or availability of an assistant. They examined Gemini on the web, on mobile and through Google Assistant, and delivered instructions through the routine channels of everyday use: calendar invitations, emails and shared documents. Their fourteen attack scenarios included spam, phishing, disinformation, extraction of the user’s data, starting media streams and controlling smart-home devices.
Their risk analysis rated 73 per cent of the threats as high or critical for end users before disclosure. After Google shipped mitigations in response, they assessed that the risk could be reduced to very low or medium, which is the encouraging half of the story: the exposure is architectural, but so are the fixes, and they work when applied.
The out-of-office reply that resigned
OpenAI’s December 2025 account of hardening its Atlas browser against injection includes an example that could stand for the whole category. An automated attacker, trained with reinforcement learning to find long, multi-step exploits, seeds the user’s inbox with an email containing instructions. Later the user asks the agent to draft an out-of-office reply. While doing so the agent reads the planted email and, following it, sends a resignation letter to the user’s chief executive instead. After OpenAI’s update the agent recognised the injection and flagged it, but the company was direct about the limit: prompt injection, like scams and social engineering on the web, is unlikely ever to be fully solved.
OpenAI’s advice to users followed from that admission rather than contradicting it. Require confirmation before an agent sends a message or makes a payment, and do not give an agent broad access to an inbox without a specific reason, because the wider its access the more it will read on an attacker’s behalf.
What the vendors changed
Google’s June 2025 description of Gemini’s defences is the fullest public account of the layers now standard in mail-connected assistants: classifiers that look for injected instructions in emails and files; a “security thought reinforcement” that reminds the model of the user’s actual task; sanitisation of Markdown and redaction of suspicious URLs so an answer cannot render an image or link that carries data out; a confirmation framework that asks the user before certain actions; and a notification when a defence has fired, so the user learns what was blocked. Microsoft’s EchoLeak fix closed the specific exit; OpenAI’s work trains the model against an automated attacker.
None of those layers is a boundary on its own, and every vendor says so. Classifiers can be talked past, as EchoLeak’s phrasing showed. Redaction closes the exits it knows about. Confirmation depends on the user reading what they are confirming. Together they raise the cost of an attack substantially, which is the realistic goal.
What you can still do yourself
Treat anything an assistant drafts from your mailbox as a draft, and read it before it is sent. Give assistants the narrowest mailbox access the task needs, a label or a folder rather than everything, and keep them out of accounts that receive one-time codes. Be suspicious of a summary that contains an instruction, a link you did not ask for, or a request to visit somewhere, because those are the marks of a message that was talking to the assistant rather than to you.
When you paste an email into an AI tool yourself, paste it as plain text first and look at what appears; a rich paste carries the message’s HTML, and HTML is where comments, hidden elements and mismatched link destinations live. The scanner on this site reads pasted HTML and Markdown without rendering either, separates the visible text from those hidden channels, reveals invisible characters as named tokens and reports instruction-shaped passages with their location. It cannot read attachments, images or a PDF, and it cannot know what your assistant is permitted to do; a clean result is a statement about the text you supplied, not about the mailbox behind it.
Primary references
These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.
- BleepingComputer: Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (EchoLeak, CVE-2025-32711, June 2025) (opens in a new tab)
- Nassi, Cohen and Yair: Invitation Is All You Need! Promptware attacks against LLM-powered assistants in production are practical and dangerous (arXiv, August 2025) (opens in a new tab)
- OpenAI: Continuously hardening ChatGPT Atlas against prompt injection attacks (22 December 2025) (opens in a new tab)
- Google: Mitigating prompt injection attacks with a layered defense strategy (13 June 2025) (opens in a new tab)
- Simon Willison: The lethal trifecta for AI agents (16 June 2025) (opens in a new tab)