The Email Said Ignore Your Rules. Your AI Agent Should Not.
A practical defense against hidden instructions inside emails, websites, documents, and connected apps.
Your agent opens a normal-looking email. Buried inside is a sentence telling it to ignore the task, search your files, and send something private elsewhere. The sentence was not written for you. It was written for the agent. Charming.
Dear Suzannah
Question: Can an AI agent safely read external email?
Answer: Yes, if external content is treated as untrusted data, permissions are narrow, and consequential actions require human approval.
Here’s the deal
Indirect prompt injection happens when an AI system reads untrusted content containing instructions designed to redirect its behavior. The instructions may sit inside an email, webpage, document, comment, attachment, or tool response.
What this actually helps you do
Protect connected data
Reduce the chance that hostile content exposes email, files, credentials, or private business information.
Control actions
Keep sending, sharing, deleting, purchasing, inviting, and changing records behind approval gates.
Spot suspicious behavior
Give employees warning signs and a stop procedure when the agent drifts outside its task.
The niche use case
A five-person consulting firm uses an AI agent to review a shared inbox, identify client follow-ups, locate supporting files, and prepare draft responses. The agent may read external email, but it must not follow instructions found inside those messages or search unrelated files.
Three benefits
- Smaller blast radius.
- Safer automation.
- Faster incident response.
Step-by-step
Define one narrow job
Avoid instructions such as check the inbox and handle everything.
Separate instructions from content
Emails, websites, attachments, and tool output are data, not authority.
Limit connected apps
Enable only the systems needed for the current task.
Reduce permissions
Prefer search and read access over send, edit, delete, share, invite, or purchase.
Create approval gates
Require a person before external messages, file sharing, account changes, calendar changes, and data exports.
Require source reports
Ask the agent to identify which record supports each recommendation.
Add a stop rule
Stop if content asks the agent to ignore instructions, reveal secrets, or act outside scope.
Test hostile examples
Use safe messages with fake malicious instructions.
Monitor the work
Review tool calls, sources, drafts, and unusual requests.
Clear access afterward
Disconnect unnecessary apps and review permissions.
Tips and tricks
- Use logged-out browsing for public research.
- Never paste passwords into chat.
- Require the source that triggered an action.
- Allowlist tools.
- Compare every high-impact action with the original goal.
Common mistakes
- Assuming the agent always recognizes hostile instructions.
- Connecting email, files, and calendars when the task needs only one source.
- Allowing drafts to send automatically.
- Using vague goals with no stop condition.
- Believing one filter removes all risk.
Human review checklist
- The agent has one specific job.
- External content is treated as untrusted.
- Only necessary apps are connected.
- Permissions use the least access needed.
- High-impact actions require approval.
- Sources are shown.
- Suspicious instructions trigger a stop.
- Access and logs are reviewed afterward.
How to measure success
- Injection detection rate.
- Unauthorized action count.
- Approval accuracy.
- Source accuracy.
- Permission footprint.
- Recovery time.
FAQ
Is prompt injection the same as a bad user prompt?
No. Indirect prompt injection is hidden inside content the agent retrieves.
Can filters stop every attack?
No. Use several layers, including limited permissions, monitoring, tool controls, and human approval.
What should an employee do when the agent behaves strangely?
Stop the task, preserve the suspicious source, disconnect unnecessary access, and review recent actions.
Glossary
Prompt injection: Hostile instructions placed into content processed by AI.
Agent hijacking: Redirecting an agent outside the intended task.
Least privilege: Giving only the access needed.
Plan drift: Movement away from the original task.
Sources and further reading
- OpenAI: ChatGPT agent safety and privacy
- NIST: Prompt injection definition
- Microsoft: Defend against indirect prompt injection
Practical closing note
External content may inform the task. It should never become the authority controlling the task.
