LangChain GmailToolkit Indirect Prompt Injection Email Exfiltration (CVE-2025-46059)
An attacker sends an email containing hidden instructions that a Gmail-connected AI agent reads and obeys instead of treating as data. The agent then searches the victim's mailbox for sensitive payment emails, drafts a copy, and sends it to an address the attacker controls, all without asking the user to confirm.
How the attack works
The attacker plants instructions inside the body of an email sent to the victim's Gmail account, expecting an AI agent (using LangChain's GmailToolkit) to process it. The buried instructions tell the agent to search Gmail for messages from payments-noreply@google.com. The agent is then directed to create a draft containing that sensitive payment content and immediately send or forward it to an attacker-controlled email address, explicitly skipping any confirmation step. The result is that the agent, acting on the attacker's hidden commands rather than the user's, exfiltrates financial email content straight out of the victim's mailbox.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 453c03b6-f805-4770-84c1-861c233e952f
- Severity
- Critical
- CVEs
- CVE-2025-46059
Why it matters
An organization can have sensitive financial or payment-related emails silently copied out of an employee's mailbox and sent to an outside party, with no user awareness or approval, because the agent's own tool permissions are used against the owner.
What you can do
- →Require explicit human confirmation before any AI agent can send or forward email, especially to external addresses, and do not allow that confirmation step to be bypassed by instructions found in message content.
- →Treat all email body text processed by an agent as untrusted data, not as commands; isolate or sanitize it before it reaches the agent's reasoning step.
- →Restrict or monitor which addresses an email-enabled agent is allowed to send to, and alert on any send/forward to a domain outside your organization's allowlist.
- →Upgrade LangChain GmailToolkit to a version that enforces human-in-the-loop confirmation for send/draft actions, and review agent logs for search-then-forward patterns involving payment-related senders.
Known benign look-alikes
- A user legitimately asking the agent to search_gmail for receipts from payments-noreply@google.com and summarize spending, with no external forwarding.
- Security advisory or remediation text mentioning CVE-2025-46059 and the GmailToolkit without the actual attack chain (e.g. describing the human-in-the-loop confirmation fix).
- Benign automation that forwards email to an internal/known recipient with normal confirmation flow.