When users utilize Generative AI for their daily work, a common use case is integrating it with email workflows. Users frequently ask AI agents to summarize their agenda, list important emails, or automatically write and send replies. Some users even employ autonomous agents to handle their inbox completely on their behalf.

Email Prompt Injection

However, without a human in the loop, this convenience creates a significant security vulnerability. Attackers can send the user an email containing a "Prompt Injection." This is often achieved by including text in the email body stating, for example, that the model should stop following its original instructions and strictly follow a new command, such as: "do x".

Privilege Escalation & Access Control

It is important to note that enterprise tools like Microsoft Copilot 365 are designed to respect existing permission structures (ACLs); they only provide access to data the specific user is normally allowed to see. However, Prompt Injection turns this feature into a vulnerability known as a "Confused Deputy" attack.

In this scenario, an attacker with low access privileges sends an email containing a prompt injection to a user with high access privileges (e.g., a CEO or Manager). When the high-privilege user's AI processes that email, it operates with the victim's clearance. The injection can trick the AI into retrieving sensitive internal files or emails—which the victim has access to, but the attacker does not—and sending that data back to the attacker. This effectively allows the attacker to steal data they could never access directly.

The Risks of Automation

When a human is in the loop (e.g., reviewing a draft before sending), this might be considered a lower risk, as the user may notice an incorrect email address or unexpected data in the draft. However, the risk escalates drastically with fully automated tools and agents (like OpenClaw) that autonomously execute workflows.

In these automated scenarios, the user may never know the attack occurred. This is especially dangerous if the attacker includes a command to "not tell the user" or to suppress confirmation messages. The agent might simply report "Action Done," while silently leaking sensitive data or files to the attacker.