When an email talks to your AI: The rise of indirect prompt injection

Malicious emails are no longer written only for human readers. Learn how attackers can target the AI assistants reading your inbox and what organizations can do to reduce the risk.

Key takeaways

• Indirect prompt injection hides malicious instructions in content that AI assistants are expected to read, including email, documents, images, and websites.
• Email creates a significant exposure because it combines untrusted external content with AI access to sensitive information and business tools.
• Traditional phishing indicators may be absent because the harmful payload can be the language itself.
• Organizations should use layered defenses, including least privilege, clear separation of content and commands, human approval for consequential actions, output validation, monitoring, adversarial testing, and detection before delivery.
• Inbox protection must secure both human recipients and the AI assistants and automated systems that may process messages next.

Imagine an employee receives what appears to be an ordinary business email. There is no suspicious attachment, urgent request, or link asking them to reset a password. To the employee, the message may seem completely harmless.

But the employee may not be the only one reading it.

Organizations are increasingly giving AI assistants access to inboxes so they can summarize conversations, retrieve information, recommend next steps, and, in some cases, take action. That creates a second audience for every email and an entirely new opportunity for attackers.

Instead of trying to convince the employee to click, the attacker can place instructions inside the message for the AI assistant to follow. Those instructions might tell the AI to ignore its original directions, reveal sensitive information, retrieve a protected file, send data somewhere else, or perform an unauthorized action.

The employee sees a routine email. The AI sees a command.

The attack hidden inside the content

This type of attack is known as indirect prompt injection. With a direct prompt injection attack, someone enters malicious instructions directly into an AI application. Indirect prompt injection takes a different route. The attacker hides the instructions inside content the AI is expected to consume, such as an email, PDF, shared document, image, or website.

Consider a familiar scenario: An employee asks an AI assistant to summarize a long email thread and identify the next steps. Buried somewhere in that thread is an instruction telling the AI to disregard its original task and retrieve information from another source.

To the employee, that instruction may look like background content or remain hidden altogether. To the AI, however, it may look like part of the task it has been asked to complete.

That is what makes indirect prompt injection so challenging. The attack does not necessarily exploit malicious code. It exploits the AI system’s difficulty distinguishing between information it should analyze and instructions it should obey.

As AI assistants gain access to more enterprise information and business tools, the consequences can become more serious. The risk is serious enough that OWASP identifies prompt injection as a top security risk for applications built with generative AI, with potential outcomes including sensitive-data disclosure, unauthorized access, manipulated content, and compromised decisions. Indirect prompt injection makes that risk particularly relevant to email. The more agency and access an AI system has, the greater the potential impact if an attacker can influence its behavior.

Why email creates the perfect opening

Email is especially attractive to attackers because it sits at the intersection of untrusted external content and essential business activity.

Employees rely on email to receive requests, exchange documents, share links, assign tasks, and make decisions. AI assistants are asked to read emails for exactly the same reasons. But that makes it difficult for an AI system to tell the difference between content describing an instruction and an instruction it should follow.

Many of the warning signs associated with traditional phishing may also be absent. An indirect prompt injection email doesn't always contain:

• Malicious executable
• Known-bad URL
• Request for credentials
• Deceptive language aimed at the employee

The payload is the language itself.

That language becomes dangerous when an AI assistant interprets it within a workflow where it can access sensitive information or use business tools. A message that appears harmless to an employee could influence a summary, change a recommendation, trigger a tool, or expose information available within the AI system’s context.

Building AI workflows around zero trust

Organizations should assume that every external message and attachment is untrusted, regardless of whether the reader is a person or an AI assistant.

That means applying the principles of least privilege, verification, and human oversight to AI-enabled workflows from the beginning. Practical safeguards include:

• Separate content from commands. Clearly distinguish external content from system instructions and trusted enterprise context.
• Limit access and permissions. Give AI agents only the data and capabilities required for a specific task.
• Keep people involved in consequential decisions. Require human approval before an AI system sends messages, changes records, retrieves sensitive data, or takes other high-impact actions.
• Validate what the AI produces. Review generated outputs and tool calls rather than relying on the model to identify every malicious instruction itself.
• Watch for unexpected behavior. Monitor unusual data access, outbound communications, and permission use.
• Test against real attack techniques. Evaluate assistants using adversarial emails, documents, images, and links.
• Prevent prompt injection before delivery. Detect and neutralize AI-targeted instructions at the email security layer before they enter inboxes and become available to copilots, agents, and automated workflows.

No single safeguard eliminates the risk. The goal is to create layers of protection so that one malicious instruction cannot move freely from an email into a privileged business action.

Protecting every reader of the inbox

Indirect prompt injection doesn’t simply rewrite phishing for AI. It changes who the attacker is trying to influence and how an ordinary piece of business content can become part of an attack.

As AI moves closer to enterprise data, decisions, and actions, email security must evolve with it. Protecting the inbox must expand to protect the employee who opens the message as well as every AI assistant, copilot, and automated system that may read it next.

Learn how to secure email and AI-enabled workflows against emerging threats in our upcoming webinar.