Guest Describes $7,000-Bounty Email Prompt Injection Against AI Agents

Summary

The host says the guest received a $7,000 bounty for an email prompt-injection technique. The guest describes using crafted content in data an AI agent reads to expose inbox information, and suggests testing coding assistants with Git commit messages.

Key points

• The host says the guest received a $7,000 bounty; the guest says the technique has been used on real targets multiple times.
• The guest describes placing prompt-injection content in email data an AI agent retrieves, then using spoofed tool output and mimicked conversation structure to influence the agent.
• In the described example, the intended impact is exposing the victim's inbox by sending its contents to an attacker-controlled email address.
• The guest says the risk applies to tool-connected AI applications that ingest content they did not write, including email and coding-assistant contexts.
• The guest describes using benign requests to check whether an injection affects the model before escalating to the desired behavior.
• The suggested practice challenge is to test an AI coding assistant with prompt-injection content in a Git commit message.