Email Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP Commands
An AI agent's email tool can be tricked into passing attacker-controlled text straight into raw IMAP mailbox commands. If a field like subject or search query contains a stray quote followed by an IMAP command word, it can break out of the intended search string and run a different mailbox command entirely.
How the attack works
An email-handling tool (search, reply, etc.) builds an IMAP SEARCH command by inserting the AI agent's tool-call arguments directly into a quoted string, without escaping. An attacker who can influence what the agent puts into fields like subject, query, or message_id supplies a value containing an embedded quote character. That quote closes the intended string early, and text right after it is then read as a new IMAP command instead of search text -- letting the attacker append verbs like DELETE, FETCH, STORE, or EXPUNGE. This can be used to read mail outside the intended folder, delete messages, or otherwise manipulate the mailbox.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- cfa2c534-7fda-475a-98c5-c9e32c93ebef
- Severity
- High
Why it matters
An attacker who can steer an agent's prompt or inputs can read, delete, or manipulate email in a connected mailbox beyond what the intended search or reply action should allow, exposing sensitive correspondence and enabling data loss.
What you can do
- →Escape or reject quote characters in any user- or agent-supplied value before it is inserted into an IMAP command string; use parameterized IMAP library calls instead of string interpolation.
- →Validate that fields like subject, from_addr, query, and message_id contain only expected characters for their purpose and reject embedded quotes or command-like tokens.
- →Restrict the mailbox account used by the agent to least-privilege IMAP permissions, limiting which folders and operations (delete, fetch, etc.) it can perform.
- →Review logs of email tool calls for arguments containing a quote character immediately followed by an IMAP verb (DELETE, UID, FETCH, STORE, HEADER, SEARCH, FLAGS, EXPUNGE).
Known benign look-alikes
- A legitimate subject/query value that contains an IMAP-verb-like English word (e.g. 'Please DELETE my old files', 'FETCH the report') without an embedded quote character breaking the string boundary immediately before it
- Documentation or an advisory describing the IMAP command-injection vulnerability class using example code, not an actual tool-call argument being set
- A value containing a single stray quote for legitimate reasons (e.g. an apostrophe in a name) that happens not to be followed by whitespace + an IMAP verb -- the verb-adjacency requirement keeps this rule from firing on incidental punctuation