When your AI assistant reads a poisoned email

You ask your AI assistant to summarize this morning's inbox. It reads 40 emails in a few seconds and hands you a tidy list. Somewhere in that pile is a message written for the assistant, not for you. It looks like an ordinary business note, but tucked inside are instructions: find anything that mentions passwords or contracts and slip it into a link.

That is prompt injection. It is one of the most widely reported weaknesses in AI language tools, according to the UK National Cyber Security Centre (NCSC), and you do not need to be an engineer to understand it or to protect yourself from it.

What prompt injection actually is

An AI assistant works by reading text and predicting what to write or do next. The trouble is that it reads everything the same way. Your request, the email it is summarizing and the web page it just opened all land in the same stream of words. If one of those sources contains something that sounds like an instruction, the assistant may follow it.

The OWASP Top 10 for LLM Applications, a widely used security reference, puts prompt injection first on its 2025 list. It separates two kinds. Direct injection is when someone types the tricky instruction straight into the chat. Indirect injection is when the instruction hides in outside content the assistant processes, such as a web page, a document or an email. The hidden text does not even need to be visible to a human, as long as the model reads it.

Indirect injection is the one that matters most at work, because you never see it coming. You did nothing wrong by asking for a summary.

A real example: EchoLeak

In June 2025, researchers at Aim Security disclosed a flaw in Microsoft 365 Copilot they called EchoLeak, tracked as CVE-2025-32711. As BleepingComputer reported, the attack began with an email that read like a normal business document. Its hidden instructions were phrased as if written to a person, which helped them slip past Microsoft's filter for this kind of attack.

The victim did not have to open anything. Later, when the user asked Copilot a related work question, Copilot pulled that email into its context as background. The planted instructions then tried to get the assistant to tuck sensitive internal data into a link or image that would quietly send it to the attacker's server.

The researchers reported the flaw to Microsoft in January 2025. Microsoft rated it critical, fixed it on its own servers in May 2025 and said it found no evidence that anyone had used it against real customers. So nobody was harmed, and that is the good news. The lesson is about design: an assistant that can read your mail and also reach out to the internet can be turned against you by a stranger's email.

It is no longer only a lab problem

For a while, most prompt injection examples came from researchers. That is changing. In March 2026, Palo Alto Networks' Unit 42 published findings from web pages seen in the wild, based on its own telemetry. The team described 12 cases and catalogued 22 techniques attackers used to hide instructions, such as plain text, hidden page attributes and styling that keeps words invisible to people.

The intents ranged from nuisance to serious: pushing irrelevant output, attempting to delete data, leaking information and trying to trigger unauthorized transactions. One page, seen in December 2025, carried 24 separate injection attempts aimed at an AI system that reviews ads, trying to get a scam ad approved. Unit 42 was careful to say it knew of no confirmed case where that trick worked against a deployed ad checker. That honesty matters. The evidence shows attackers are trying, and the scale of real harm is still unclear.

Why there is no simple fix

You might expect a patch to make this go away. The NCSC says otherwise. In a December 2025 blog post, its experts explained that language models do not separate instructions from data, so prompt injection may never be fully fixed the way older injection flaws were. The NCSC suggests treating an AI model as an "inherently confusable deputy" and planning around that.

The practical goal is to make a successful injection boring: the assistant gets confused, but it cannot reach anything valuable or do anything you have not approved. In May 2026, the NCSC and international partners published joint guidance on agentic AI, the kind that takes actions on its own. As the NCSC summarized it, the advice is to start small with low-risk tasks, give agents only the minimum access they need for the shortest time and make sure a named person can approve or stop what the agent does.

Habits that keep the damage small

You do not need to stop using AI. You need a few habits, and they work for a solo user, a small team or a whole organization. Copy this list into your team wiki.

1. Give tools the least access they need. If an assistant only summarizes documents, it does not need to send email, browse the web or reach your finance system. Turn off connections you do not use.

2. Confirm before any action. Set assistants to ask before they send, pay, delete, share or change anything. Read the confirmation itself before you click.

3. Do not let assistants act on untrusted content unattended. An agent that reads inbound email or random web pages should not also be able to act on what it reads without a human in the loop.

4. Treat surprising output as a signal. If a summary suddenly urges you to click a link, approve a payment or "verify" your login, stop. That instruction may have come from the content, not from your assistant.

5. Keep secrets out of reach. Do not store passwords, API keys or customer records in places your assistant can read unless it truly needs them.

6. Report it, without blame. If you think an assistant was tricked, tell IT or security right away. You found a flaw in a tool, which is useful, and nobody should feel embarrassed about it.

For teams rolling out assistants, add two more: name an owner for each AI tool who decides what it can touch, and review those permissions every few months as features change.

The thread running through all of this is simple. AI tools are powerful helpers, and you stay the one in charge. A pause before any action and a clear rule about what the assistant may touch will defuse most poisoned emails before they matter.

Sources

• OWASP Gen AI Security Project, "LLM01:2025 Prompt Injection," 2025: genai.owasp.org

• BleepingComputer, "Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot," June 11, 2025: bleepingcomputer.com

• Palo Alto Networks Unit 42, "Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild," March 3, 2026: unit42.paloaltonetworks.com

• UK National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)," Dec. 8, 2025: ncsc.gov.uk

• UK National Cyber Security Centre, "Thinking carefully before adopting agentic AI," May 15, 2026: ncsc.gov.uk

• UK National Cyber Security Centre, "AI and cyber security: what you need to know," Feb. 13, 2024: ncsc.gov.uk

Or let NimBot handle it

You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.