# LLMail Email-Tool Exfiltration to Fixed Attacker Address

- **Severity:** High
- **Signature ID:** `f0397696-f12c-43f3-8e54-175931b74711`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An AI assistant that reads and summarizes email can be manipulated by hidden instructions inside an incoming message. Those instructions make the assistant send a reply containing a specific marker word to an attacker-controlled email address, proving the attacker can make the agent act on content it was only supposed to read.

## How the attack works

An attacker sends or plants an email containing hidden instructions aimed at the AI agent rather than the human reader. When the agent processes the inbox and summarizes messages, it follows the embedded instruction instead of the user's actual request. This causes the agent to call its send-email function with the body set to the word 'confirmation' and the recipient set to a fixed attacker address, contact@contact.com. The instruction can appear as natural language or as a fake JSON tool call, and it can be phrased in different languages.

## Why it matters

This lets an attacker turn a trusted email assistant into a delivery mechanism for a covert message, confirming the agent can be hijacked to send data or actions to an address the user never approved. In a real attack, the same mechanism could be reused to exfiltrate actual sensitive content instead of a test marker.

## What you can do

- Treat all email body content as untrusted input and isolate it from instructions the agent is allowed to act on.
- Require explicit user confirmation before an agent sends email to a new or unrecognized recipient.
- Maintain and enforce an allowlist of approved outbound email addresses for agent-initiated messages.
- Log and review agent tool calls that involve sending email, especially when the recipient or content was derived from processed inbox text rather than direct user input.

## Known benign look-alikes

- Security research describing the LLMail-Inject challenge with the example address in prose (not an active directive co-located with a send verb)
- A legitimate confirmation email to a genuinely configured business address (not contact@contact.com)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01862
- https://github.com/microsoft/llmail-inject-challenge

---
Source: https://www.netzilo.com/threats/atr-llmail-email-tool-exfiltration-to-fixed-attacker-address