Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents

arXiv:2507.02699 · cs.CR · Submitted 2025-07-03 · Read on arXiv

cs.CR

Submitted: 2025-07-03

Updated: 2026-09-27

Comments: Accepted at NDSS 2027. Full version with expanded experiments and analysis

Code: https://github.com/HKUDS/AutoAgent

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Agent Hijacking — 15× in this paper · explained in 1 episode
Large Language Model — 12× in this paper
Email Agent Hijacking — 10× in this paper
Core — 8× in this paper · explained in 2 episodes
Benchmarking — 2× in this paper · explained in 3 episodes
Decode — 2× in this paper · explained in 2 episodes
Verification — 2× in this paper · explained in 2 episodes
Abstraction — 1× in this paper · explained in 1 episode
Advanced Persistent Threat — 1× in this paper
Adversarial Attacks — 1× in this paper · explained in 1 episode
Alignment — 1× in this paper · explained in 1 episode
Downstream Tasks — 1× in this paper · explained in 2 episodes
Email-Specific Prompt Injection — 1× in this paper
Fine-Tuning — 1× in this paper · explained in 5 episodes
Generative Model — 1× in this paper · explained in 2 episodes
Generative Models — 1× in this paper · explained in 2 episodes
In Network and Distributed System Security Symposium — 1× in this paper
Information Leakage — 1× in this paper · explained in 2 episodes
Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
Reinforcement Learning — 1× in this paper · explained in 4 episodes
Robustness — 1× in this paper · explained in 5 episodes
Semantic Understanding — 1× in this paper · explained in 2 episodes
Task Decomposition — 1× in this paper · explained in 2 episodes

Sources

Can Indirect Prompt Injection Attacks Be Detected and Removed?

Related papers