Unverified50% confidenceFactExact time
The email scenario is a typical case of indirect prompt injection: the attacker does not need to contact the victim and can complete the poisoning simply by sending one email.
1
Sources
50%
Confidence
Long-term
Relevance
11/3/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedCase one, "EchoLeak": an implanted email caused Copilot to send private data to an attacker with zero clicks; the issue has been fixed on the server side, and no abuse reports have been seen.73% similarUnverifiedPrompt injection attacks can hide malicious instructions in the HTML source code of emails; when the model summarizes an email, it may be induced to ignore system prompts and execute malicious operations, with the risk being especially prominent for smaller or older models.71% similarUnverifiedPrompt injection attacks in the MCP context can be carried out via a plain-text email: the model calls a read-only tool to read the email, the email contains malicious content such as "ignore previous instructions," and the model cannot always distinguish data from instructions, thereby attempting to perform dangerous operations (such as sending a private key file).70% similarUnverifiedThe original post gives an example of a tool-layer mitigation: after reading an unknown email, block sending emails to new recipients.70% similarUnverifiedIndirect prompt injection is especially dangerous because an attacker can carry out the attack without directly touching the user.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1132370API
curl https://kongchang.com/api/v1/knowledge/claims/1132370MCP
get_claim(id=1132370)