Prompt-Injection on t0ul

When the email gives orders

Tue, 04 Nov 2025 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

The first red line

The baseline post ended on a board full of attacks the agent could not withstand, and showed one of them landing: an email with an instruction buried in it, and a model that followed the instruction. Now we have the lens from Part 2, so this time we do not just watch it land. We add the control, and we watch the same attack go to zero, against the real model, measured.

The email is data, not orders

Tue, 11 Nov 2025 00:00:00 +0000

When the filter misses

The last post stopped an injection by stripping the offending line before the model saw it. That sanitizer works, but it works by recognizing the shape of an attack, and anything that recognizes a shape can be slipped past by a shape it has not seen. So underneath it there has to be a second idea that does not depend on spotting the attack at all: the model should treat the entire email as data it reads, never as instructions it obeys, so that even an order the filter misses is still just text about an event, not a command.

System-prompt leakage

Tue, 18 Nov 2025 00:00:00 +0000

The mirror attack

The last two posts were about an email that plants an instruction. This one is the reverse, and it is easy to overlook because it does not change what the agent does, only what it says. Instead of giving the model a new order, the attacker asks the model to hand over the orders it already has: its system prompt, the instructions that tell it how to behave and, crucially, what it has been told to refuse. That prompt is the blueprint of the agent’s defenses. Leak it, and an attacker stops guessing and starts reading your rules, looking for the gap. OWASP files this under LLM07, system-prompt leakage, and it is the last injection problem in this chapter.

Index poisoning

Tue, 24 Mar 2026 00:00:00 +0000

The injection that waits in the index

The last post built retrieval: the agent answers a question by pulling the relevant passages out of a store and putting them in front of the model. That store is filled from emails, and an email is untrusted. So the obvious attack is to get a document into the index whose text is not a fact but an instruction, and then wait. It does nothing until a question retrieves it, at which point it rides into the prompt and speaks to the model directly, with none of the scrutiny a freshly arrived email would get, because by now it is just something the agent remembered.

Memory poisoning and lifecycle

Tue, 07 Apr 2026 00:00:00 +0000

An injection on a delay

The last two leaks were about retrieval in the moment: a poisoned document steering an answer, one household’s email reaching another. This one is about time. An agent that is any use remembers things across emails, a preference, a recurring event, a fact it summarized last week, and recalls them later to answer. The moment it does, memory becomes an injection on a delay. Plant a note today whose text is an instruction, and it does nothing until some ordinary recall drops it into a prompt, where it arrives wearing the authority of something the agent chose to remember.

Honest eval methodology

Tue, 12 May 2026 00:00:00 +0000

When the ruler is a model

The flywheel runs on measurement, and some of the things worth measuring do not have a tidy numeric answer. Was this summary faithful? Was this reply helpful? The usual move is to ask a model: give a stronger LLM the rubric and the output and have it return a score, model-as-judge, often sampled k times so you can talk about pass@k, the chance the agent gets it right in k tries. It is a genuinely useful technique, and it has a sharp edge that the rest of this book should make you flinch at: the judge reads the output, and the output came from a system that reads untrusted email.

The UI and chat

Tue, 14 Jul 2026 00:00:00 +0000

The surface people actually touch

Everything the agent does finally shows up in one place a person uses: a chat box. You ask it a question in plain language, it pulls the relevant things out of everything it has ever read, and it answers. It is the friendliest surface in the whole product and the most exposed, because “everything it has ever read” is a corpus full of untrusted email, and the chat’s job is to put pieces of that corpus into a prompt and answer from them.

Context compaction and summarization injection

Tue, 15 Sep 2026 00:00:00 +0000

The summary is trusted context

A long-running agent runs out of room. The context window is finite, the conversation is not, so at some point the agent has to compact: summarize the older turns into a short running summary and keep only the recent ones verbatim. It is a reliability mechanism, the thing that lets a session last all day without blowing the budget. It is also, like durable resume, a place where the agent starts trusting something it generated earlier.