Unverified50% confidenceFactExact time
Prompt injection attacks can hide malicious instructions in the HTML source code of emails; when the model summarizes an email, it may be induced to ignore system prompts and execute malicious operations, with the risk being especially prominent for smaller or older models.
1
Sources
50%
Confidence
Long-term
Relevance
10/26/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPrompt injection attacks in the MCP context can be carried out via a plain-text email: the model calls a read-only tool to read the email, the email contains malicious content such as "ignore previous instructions," and the model cannot always distinguish data from instructions, thereby attempting to perform dangerous operations (such as sending a private key file).77% similarVerified间接提示注入可将恶意指令藏入外部数据源（如网页、文档），待代理读取时自动触发攻击77% similarUnverifiedPrompt injection is divided into two categories: direct injection (the user directly enters malicious instructions in the conversation) and indirect injection (malicious text hidden in retrieved content such as PDFs, web pages, and emails).71% similarUnverifiedInbound emails or webhooks originating from the public internet are untrusted inputs and carry the risk of prompt injection.71% similarUnverifiedThe system prompt should declare that text within email tags is untrusted customer content and that instructions within it should never be followed, in order to guard against prompt injection.71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1101170API
curl https://kongchang.com/api/v1/knowledge/claims/1101170MCP
get_claim(id=1101170)