How Prompt Injection Can Hijack AI Agents Connected to Your Email

Summary

A security researcher explains how emails or shared content can prompt-inject AI agents with third-party connectors, hijack their tasks, expose sensitive data, and exfiltrate it through image requests or connector write actions.

Key points

• The guest explains that connecting AI agents to email, calendars, or knowledge bases gives them access to sensitive information—and can increase the impact of prompt injection.
• A crafted email can trick an agent into changing its task and using its connected-account permissions on an attacker’s behalf.
• The guest describes a proof of concept in which an injected instruction directs an agent to retrieve sensitive information and send it to an attacker-controlled site through an image-loading request.
• The discussion describes other possible exfiltration paths through connectors with write access, including placing a password-reset token in a calendar invitation or a document.
• The guest says prompt injections hidden in shared enterprise knowledge bases could affect multiple users whose agents consult that content; this is presented as a potential scaling risk.
• The guest says they demonstrated connector attacks at a live hacking event and recalls that one bug-bounty award was several thousand dollars.