AI Agent Prompt Injection Lab Demonstrates Token Exfiltration and Guardrail Bypasses

Summary

Red team researcher Mike demonstrates indirect prompt injection against an email-connected AI agent, showing how a lab token can be exfiltrated and how simple output filters can be bypassed.

Key points

• Indirect prompt injection places instructions in external content, such as emails, websites or repository files, that a victim’s AI agent reads.
• Mike describes a lab based on a bug bounty finding involving indirect prompt injection and data exfiltration.
• In the lab, an injected email directs an agent to find a password-reset token and send it to a listener.
• A second lab level blocks a secret in an outbound URL, but inserting characters into the token bypasses the demonstrated filter.
• The researchers explore encoding and reframing against a more guarded model; results vary, and a later retest is refused.
• Mike recommends documenting nondeterministic behavior and retrying tests when reporting AI agent vulnerabilities.