Every Stranger With Your Email Can Now Hack Your AI Agent

I shared my AI automation setup on LinkedIn:

Meeting finishes. AI reads the Fireflies transcript. Detects it was a sales meeting. Creates a custom SOW from my template. Writes the follow-up email. Sends it. Updates Pipedrive with the deal.

"Just tell us your email so we can send prompt injection attacks."

"We could make your AI leak all your leads."

"Hand over that Pipedrive data."

They were not joking. And they were not wrong.

This is called prompt injection. And if your AI agent reads untrusted content like emails and takes actions, you are vulnerable. It is more precisely known as indirect prompt injection. The attacker is not talking to your AI directly. They are planting instructions in content your AI will read.

What Is Prompt Injection?

Prompt injection is when someone hides instructions inside content your AI reads.

Your AI does not know the difference between your instructions and instructions embedded in an email. If it reads text, it might follow text. That is the entire problem.

An innocent-looking email with hidden instructions designed to hijack your AI agent.

Your AI reads the email body the same way it reads your instructions. It cannot tell the difference between a legitimate request and a malicious command hidden in white text, a tiny font, or an encoded string. That is the fundamental vulnerability.

Example Attack Email

Here is what an attack looks like in practice:

If your AI treats email content as instructions, it might execute this. The hidden text is invisible to you but perfectly readable by your AI.

Other Attack Patterns

Beyond Text: Multimodal Injection

These attacks are not limited to email body text. Prompt injection can be embedded in PDF attachments, images with hidden text layers, spreadsheet metadata, and structured data like calendar invites or vCards. If your AI agent processes any file type, not just email text, extend your security posture to cover every input channel it touches.

How to Protect Yourself

There are three real layers of protection. I will be straight with you about which ones actually matter.

Defence in depth means no single layer carries the full load. Your AI agent configuration is the foundation, email scanning catches lazy attacks, and monitoring tells you when something slips through. Together they shrink your attack surface dramatically.

Defence in depth: multiple layers working together.

Layer 1: Your AI Agent Configuration (The Foundation)

This is the layer everything else builds on. If you only do one thing, start here.

Your AI agent should treat ALL email content as untrusted user data. Never as instructions. System prompt rules are not foolproof. A determined attacker can work around them. But without this foundation, the other layers have nothing to protect.

Add to your agent system prompt:

Restrict permissions to the minimum your workflow needs:

Layer 2: Email Scanning Rules (Helpful, Not Magic)

Let me be honest: no email filter will stop a real prompt injection attack. The attacker is not going to put "ignore previous instructions" in the subject line. The whole point of these attacks is that they are hidden.

That said, basic scanning rules cost nothing and catch the laziest attempts. Think of them as a smoke detector, not a firewall.

If you use Google Workspace, set up a Content Compliance rule with regex. This is the only version worth doing because it supports pattern matching that basic Gmail filters cannot.

Admin Console: Apps > Google Workspace > Gmail > Compliance

Action: Quarantine or add X-header for review. Takes about 15 minutes to set up.

If you only have regular Gmail, you can create a filter with "Has the words" using keywords like "ignore previous", "system prompt", "SYSTEM:", "[INST]" and route matches to a "Suspicious-AI" label. It is basic keyword matching with no regex, so it catches very little. Do it if you want, skip it if you have Workspace. The compliance rule above covers it.

Layer 3: Monitoring and Alerts

Even with good agent configuration and email scanning, you need to know when something gets through.

Set up alerts for:

Google Security Dashboard: myaccount.google.com/security

Workspace Admin: Admin Console > Reporting > Audit and investigation

Weekly review: Check suspicious label, last account activity, security dashboard.

For OpenClaw/Clawdbot Users

If you use OpenClaw or Clawdbot, there is a full Security Hardening course at learn.openclaw.academy.

Copy the instruction below and paste it straight into your agent:

Your agent will:

Covers prompt injection defence, DM/group access policies, sandbox vs tool policy vs elevated, secrets management, audit logging, and incident response.

Takes 10 minutes. Your agent does the work.

Quick Setup Checklist

The difference between a vulnerable AI agent and a hardened one.

Everything below takes less than 30 minutes total and costs nothing. The alternative is a compromised agent leaking your client data, forwarding your pipeline, or sending emails on your behalf. That is not a hypothetical. It is what happens when someone tests your setup and you have not locked it down.

Right Now (10 mins, do this first)

This Week (15 mins)

Good Habits (ongoing)

OpenClaw Users (10 mins)

Two More Things Worth Knowing

Log Everything Your AI Does

Keep a full audit trail of every action your AI agent takes. Every email read, every draft created, every CRM update. If an attack gets through, the logs are how you find out what happened and what was exposed.

Validate Outputs, Not Just Inputs

Do not just filter what goes into your AI. Check what comes out before it executes. Rate-limit outbound actions (no AI should send 50 emails in a burst). Validate that recipients are in an approved list before sending. Queue high-risk actions for human review rather than trusting the AI to "ask" for confirmation. That confirmation flow itself can be bypassed by injection.

The Key Insight

Your AI should NEVER execute instructions found in emails.

Read them? Fine.

Summarise them? Great.

Act on commands inside them? Absolutely not.

The moment your AI treats email text as instructions, you have given every stranger with your email address a way in.

Lock it down before someone tests it for you.

Frequently Asked Questions

What is prompt injection in AI agents?

Prompt injection is when an attacker hides malicious instructions inside content that your AI agent reads, such as emails, documents, or messages. The AI cannot distinguish between your legitimate instructions and the attacker's hidden commands, potentially causing it to leak data, forward emails, or take unauthorised actions.

Can Gmail filters stop prompt injection attacks?

Not really. Gmail filters use basic keyword matching and no attacker is putting "ignore previous instructions" in a visible email. If you have Google Workspace, Content Compliance rules with regex are more useful because they can pattern-match across the full email body. But the real protection is your AI agent configuration: treating all email content as untrusted data and never executing instructions found within it.

How do I secure my AI agent that reads emails?

Start with your AI agent configuration. This is your foundation. Add strict system prompt rules that treat all email content as untrusted data and never execute instructions found within it. Then layer on Google Workspace Content Compliance rules for regex-based email scanning, and set up monitoring alerts for suspicious activity like forwarding rule changes and unusual sending patterns. No single layer is enough on its own.

What permissions should my AI agent have for email?

Follow the principle of least privilege. Allow reading and summarising emails. Allow drafting replies but not auto-sending. Require explicit human confirmation before sending, forwarding, or clicking any links found in emails. Never allow your AI to auto-click URLs from incoming emails.

Is my business automation safe from prompt injection?

If your AI agent reads untrusted content like incoming emails and has the ability to take actions like sending emails, updating CRMs, or accessing APIs, then you are potentially vulnerable. The risk increases with the level of permissions your AI agent has. Implement the four layers of protection described in this guide to significantly reduce your attack surface.