Picture an employee who runs a local AI agent with access to their mail client, browser, and files. Each morning, it summarizes and prioritizes the emails received overnight. One message, which looks like a routine supplier email, contains no clickable link. Instead, white-on-white text tells the agent how to build one. The text directs the agent to take the supplier’s name, add a hyphen and the word “portal,” append the usual domain ending, add a path ending in “invoice-viewer,” and fetch the file the URL serves so the latest invoice can be reviewed.
The dutiful agent builds the URL, clicks it, and downloads a remote access trojan (RAT) that gives the attacker control of the laptop and access to everything reachable from it. The human user never clicked anything. Because the message contained no actual URL, the email security system’s link scanning and URL rewriting had nothing to inspect or rewrite. Any organization that lets an AI agent read mail, whether a copilot in the cloud or a local agent on an employee’s endpoint, has unwittingly opened a new path for attackers.
Email Security Systems Were Built to Defend a Human Reader
Secure email gateways (SEGs) and integrated cloud email security (ICES) tools, which connect to the mail platform through application programming interfaces (APIs), inspect links, attachments, sender reputation, and sender authentication using Domain-based Message Authentication, Reporting and Conformance (DMARC). They also look for social engineering cues in message content designed to trick people. A prompt injection payload aimed at an AI reader can avoid all of these signals. It can come from a legitimate, authenticated sender, carry no link or attachment, and be written as plain instructions addressed to the AI agent rather than to the person.
Researchers have already demonstrated this kind of attack against Google’s Gemini for Workspace. In a July 2025 disclosure through 0DIN, Mozilla’s bug bounty program for generative AI, Marco Figueroa hid instructions in an email using HTML and Cascading Style Sheets (CSS) formatting that set the text color to white. The recipient never saw the hidden text, but Gemini read it. When the recipient asked Gemini to summarize the message, the summary included the attacker’s fake warning that the user’s Gmail password had been compromised, plus a phone number to call. Google patched the flaw and reported no known real-world exploitation.
Early Evidence in the Wild
The most significant case to date is EchoLeak. Microsoft tracked it as CVE-2025-32711 and rated it Critical. In the attack a Microsoft 365 Copilot user received an email with hidden instructions. When the user later asked Copilot a routine question, Copilot pulled that email into its context through Microsoft Graph, followed the instructions, and sent internal data to the attacker. Researchers called it the first known zero-click attack on an AI agent.
Broader data shows attackers are already experimenting with the prompt injection technique. In an April 2026 report, Google researchers who scanned archives of the public web found a 32% increase in malicious prompt injections between November 2025 and February 2026. Google rated the attacks as unsophisticated but expected them to grow in scale and sophistication as attackers adopt agentic AI of their own. A 2026 Cloud Security Alliance research note, citing the Open Worldwide Application Security Project (OWASP) GenAI Security Project, concluded that prompt injection has moved into live exploitation.
Published evidence of email-borne prompt injection exploited at scale is still thin. The Google data does not cover email delivery specifically, but attackers have always been opportunistic. As agentic email readers spread, the inbox becomes an obvious target.
From a Reading Problem to an Action Problem
A fooled AI email summarizer can, at worst, produce a misleading summary. An agent that can reply, forward, schedule meetings, update customer relationship management (CRM) records, approve invoices, browse the web, download and open files, and call tools through the Model Context Protocol (MCP) can turn a single poisoned message into real damage, carried out with the user’s authority.
Agents can also make detection and response harder. As I described in my post Why Securing AI Agents Starts with Visibility and Observability, agents often run with delegated authority, inherited credentials, and no accountable owner, which makes it hard to reconstruct what an agent did after reading a poisoned message. Jonathan Care’s recent post, A Peek into AIID2026: AI Agents Are the New Insider Threat, covers prompt injection as one route by which agents become insider threats. Email is one of the most direct ways to deliver a prompt injection.
What Buyers Should Consider for Their Email Security Solution
- Architecture: Attacks on agentic email readers are likely to reopen the debate between SEGs and API-based ICES products. SEGs generally block messages before they reach the inbox, while API-based products generally remove malicious messages after delivery, a time gap that was tolerable when a person was the target. Because an agent can act on a message within milliseconds of arrival, it may act before a post-delivery tool removes the message, which makes that model harder to defend.
- Detection: Does the product treat hidden or instruction-like content, such as zero-size fonts, white-on-white text, and off-screen elements, as a risk signal even when no malicious link is present? Can it flag instructions that spell out a URL or describe an action in words, as in the opening scenario, as possible prompt injections?
- Boundary between mail and AI: Can the solution, or controls downstream of it, stop copilots from processing messages from external senders or messages carrying sensitivity labels and govern what an agent does next, such as resolving a link or running a downloaded file? Microsoft’s guidance after EchoLeak took this approach, recommending data loss prevention (DLP) policies that block agent-based processing of external emails.
- Telemetry correlation: Can email telemetry be correlated with agent activity so a security operations center (SOC) analyst can trace an agent’s action back to the triggering message?
Who or What Is Reading Your Email?
Think back to the employee whose agent downloaded a RAT. The user did nothing wrong, yet the controls designed to protect them never fired. Security leaders should ask whether AI assistants and local agents in their environment read email today, what each can do after reading it, and whether anyone has asked their email security vendor what happens when the email reader is an agent. Agentic email readers deliver real productivity gains, but defenders need to close the new exposures those readers open.
