Email-Borne Prompt Injections Could Expose Data Through Enterprise AI Assistants
Summary
Email-delivered prompt injections can manipulate AI assistants into exposing sensitive information or altering workflows. Darktrace reports increased signals of possible attempts and describes using prompt density, obfuscation, and behavioral context to detect them.
Key points
- Prompt injection hides instructions in content an AI assistant processes, such as an ordinary email, rather than relying on a user to click a link or open an attachment.
- A successful attack could make an AI disclose sensitive information or influence future workflow responses.
- The article cites ShadowLeak, a now-patched ChatGPT flaw involving an email-connected agent, and HashJack, which hides instructions in trusted website URL fragments.
- Darktrace reports a 90% increase in customer deployments showing signals associated with potential prompt injection since it began monitoring in late 2025; it says the signals do not definitively establish attribution.
- Variable wording makes simple pattern matching unreliable, while hidden text may be readable to AI systems but not visible to people.
- Darktrace describes assessing clusters of prompt-like language, obfuscation, and whether email content deviates from normal communication patterns.
Article Details
- Topic
- Email-delivered prompt injection risks to enterprise AI assistants, including data exfiltration and workflow manipulation, and Darktrace’s detection approach.
Vendors
DarktraceAt Darktrace, our analysis has shown an increase of 90% in the number of customer deployments showing signals associated with potential prompt injection attempts since we began monitoring for this type of activity inOpenAImethod to exfiltrate PII identified in September 2025. This was a flaw in ChatGPT (now patched by OpenAI) which worked via an agent connected to email. If attackers sent the target an email containing a hidden
Products
ChatGPTis a prompt injection method to exfiltrate PII identified in September 2025. This was a flaw in ChatGPT (now patched by OpenAI) which worked via an agent connected to email. If attackers sent the target anDarktrace / EMAILVisit the Darktrace / EMAIL product hub to discover how we detect and respond to advanced communication threats.