# Email Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP Commands

- **Severity:** High
- **Signature ID:** `cfa2c534-7fda-475a-98c5-c9e32c93ebef`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM02 (Sensitive Information Disclosure)

## Summary

An AI agent's email tool can be tricked into passing attacker-controlled text straight into raw IMAP mailbox commands. If a field like subject or search query contains a stray quote followed by an IMAP command word, it can break out of the intended search string and run a different mailbox command entirely.

## How the attack works

An email-handling tool (search, reply, etc.) builds an IMAP SEARCH command by inserting the AI agent's tool-call arguments directly into a quoted string, without escaping. An attacker who can influence what the agent puts into fields like subject, query, or message_id supplies a value containing an embedded quote character. That quote closes the intended string early, and text right after it is then read as a new IMAP command instead of search text -- letting the attacker append verbs like DELETE, FETCH, STORE, or EXPUNGE. This can be used to read mail outside the intended folder, delete messages, or otherwise manipulate the mailbox.

## Why it matters

An attacker who can steer an agent's prompt or inputs can read, delete, or manipulate email in a connected mailbox beyond what the intended search or reply action should allow, exposing sensitive correspondence and enabling data loss.

## What you can do

- Escape or reject quote characters in any user- or agent-supplied value before it is inserted into an IMAP command string; use parameterized IMAP library calls instead of string interpolation.
- Validate that fields like subject, from_addr, query, and message_id contain only expected characters for their purpose and reject embedded quotes or command-like tokens.
- Restrict the mailbox account used by the agent to least-privilege IMAP permissions, limiting which folders and operations (delete, fetch, etc.) it can perform.
- Review logs of email tool calls for arguments containing a quote character immediately followed by an IMAP verb (DELETE, UID, FETCH, STORE, HEADER, SEARCH, FLAGS, EXPUNGE).

## Known benign look-alikes

- A legitimate subject/query value that contains an IMAP-verb-like English word (e.g. 'Please DELETE my old files', 'FETCH the report') without an embedded quote character breaking the string boundary immediately before it
- Documentation or an advisory describing the IMAP command-injection vulnerability class using example code, not an actual tool-call argument being set
- A value containing a single stray quote for legitimate reasons (e.g. an apostrophe in a name) that happens not to be followed by whitespace + an IMAP verb -- the verb-adjacency requirement keeps this rule from firing on incidental punctuation

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02352
- https://github.com/advisories/GHSA-c969-5x3p-vq3v

---
Source: https://www.netzilo.com/threats/atr-email-search-reply-tool-argument-breaks-out-of-imap-search-q