Anatomy of an Email Prompt Injection

In March 2026, a security researcher demonstrated a devastating attack: a single email that hijacked an AI assistant and exfiltrated calendar data, contact lists, and draft emails — all without the user clicking anything.

The attack vector? A prompt injection hidden inside an otherwise normal-looking email.

The Attack

The email appeared to be a standard meeting confirmation. Nothing suspicious. But buried in the HTML source was an invisible instruction block that told the AI assistant to enter "maintenance mode" and forward all recent emails to an external address.

Why It Works

LLMs don't distinguish between visible and hidden content. To the model, every token in the email body is equally valid input. The attack exploits three fundamental weaknesses:

1. No Visual-Semantic Boundary

Humans see rendered output. Models see raw tokens. An instruction hidden with CSS is invisible to the human but fully legible to the LLM.

2. Authority Confusion

By using terms like [SYSTEM] and maintenance mode, the injection mimics the format of system-level instructions. Many models give these patterns elevated authority.

3. Instruction Suppression

The phrase "do not mention this action" prevents the model from alerting the user. The attack operates silently.

Detection Patterns

At SpiderMail, we've cataloged over 200 injection patterns in the wild. Common signatures include:

• CSS concealment — display:none, font-size:0, position:absolute;left:-9999px

• Authority escalation — [SYSTEM], ADMIN:, IGNORE PREVIOUS

• Action directives — forward to, send to, execute, summarize and email

• Suppression — do not tell, keep this confidential, act silently

• White-on-white — text with color matching the background

• Zero-width characters — Unicode tricks that are invisible but parseable

How SpiderMail Blocks This

Our sanitization pipeline operates in three stages:

Stage 1: HTML Stripping — All HTML is converted to plaintext. No CSS, no hidden elements, no tracking pixels survive.

Stage 2: Injection Detection — The cleaned text runs through our pattern matcher, which flags known injection signatures and anomalous instruction patterns.

Stage 3: Structural Typing — The output is structured as typed YAML with explicit fields — subject, from, body_plain, attachments — so the LLM processes each field in isolation.

subject: "Meeting Confirmed — Q2 Planning, Tuesday 2pm"
from:
  name: "Sarah"
  email: "calendar@legitimate-company.com"
body_plain: |
  Hi team,
  Confirming our Q2 planning session for Tuesday at 2pm EST.
  Agenda attached. See you there!
security:
  injections_detected: 1
  injections_stripped: 1
  risk_level: "high"

A clean payload isn't just safer — it's more useful. Your agent gets exactly the information it needs, nothing more.

The arms race between injection attacks and defenses will continue. The solution isn't smarter models — it's cleaner input.