An artificial intelligence (AI) assistant can read an email, website, or document that contains instructions from someone other than you. Researchers call this indirect prompt injection. A malicious sender does not need your permission to place that content in a source your assistant can read.
Two research examples, with important boundaries
EchoLeak, disclosed in 2025. The researchers described a chain affecting Microsoft 365 Copilot in which an attacker-controlled email could lead to information disclosure through indirect prompt injection. Treat it as a documented, addressed vulnerability in a particular system and configuration, not proof that every current Copilot deployment has that flaw. Its broader lesson is to examine the whole retrieval and output path.
KnowBe4's September 2026 lab report. In its Gmail sidebar test, hidden instructions caused unrelated inbox information to appear in a response, while sidebar controls blocked the attempted outward transfer. A separate Apps Script workflow using an older Gemini model wrote unsanitized model output into an HTML draft; opening the draft caused an image request that carried out a code from the supplied context. The newer models tested resisted that injection. The two setups had different controls and outcomes. KnowBe4 sells email security, which readers should consider alongside the reported evidence.
The lessons for a person
- An instruction to examine one message does not necessarily narrow the access already granted.
- Read-only access still exposes what the assistant reads.
- Output can have effects while it is displayed, before a person presses Send.
- Newer models and provider safeguards help, but do not make the workflow risk-free.
- A familiar sender can be compromised. Choose and review inputs, limit connections, and check important responses against the originals.
The lessons for a builder or IT team
Limit readable resources and inherited context. Separate retrieval, output rendering, and execution. Prevent unauthorized outbound requests. Validate recipients and destinations independently of the model. Test with synthetic data, protect the activity evidence, and repeat tests after a model, tool, policy, or client changes.
For browser agents, include signed-in sessions, installed extensions, local files, and password-manager access in the review. A separate browser profile reduces shared-session exposure; it is not a complete security boundary.
Keep going
- Start Here for the lower-access personal workflow.
- Advanced for agents and browser access.
- For IT and Security Teams for tests and a release gate.
Primary sources
The author develops commercial security tools in this area. These resources are tool-neutral and recommend no product. Product names, when used, are examples rather than endorsements. Own IT, Secure IT, and Protect IT draw on the 2019 Cybersecurity Awareness Month theme; Monitor IT extends the cycle into a repeatable personal habit. General educational information, not a scan, compliance assessment, or guarantee of safety. CC BY 4.0.
Apply this in your organization
We help translate these attack lessons into scoped security design, hardening, testing, and response improvements. Explore security services, or discuss your priority by email.