LLMail Fake Email-Boundary Marker Injection

How the attack works

An attacker sends or plants an email whose body contains normal-looking text followed by a fabricated separator like '[EMAIL_END_INDICATOR]', '[Email End Marker]', or '{{ Email 2 }}'. This separator mimics the internal formatting an AI mail agent uses to distinguish between multiple messages in a conversation thread. After the fake separator, the attacker adds a new instruction, such as telling the agent to send a 'confirmation' email to a specific address. Because the AI treats the forged marker as a genuine boundary, it attributes the injected instruction to a separate, seemingly legitimate message rather than recognizing it as part of the original attacker-controlled email, and may act on it as a trusted command.

Netzilo detection

Why it matters

An AI email agent can be manipulated into sending emails, exposing information, or taking other actions on the attacker's behalf without the user's knowledge or approval.

What you can do

• →Configure email-summarizing agents to treat all content within a single retrieved email as untrusted, regardless of internal formatting that appears to mark boundaries.
• →Strip or normalize suspicious delimiter-like strings (e.g. bracketed 'EMAIL START/END', numbered '{{ Email N }}' patterns) from email bodies before they reach the agent's context.
• →Require explicit user confirmation before an agent executes any tool call that sends messages or takes external action, especially when the instruction originates from processed email content.
• →Review agent logs for tool calls triggered immediately after unusual bracketed marker text in email bodies.

Known benign look-alikes

• An email-threading library's documentation literally showing a delimiter token as an example
• A numbered list rendered as [ Email 1 ] in a benign table of contents without an adjacent directive

References

• https://agentthreatrule.org/en/rules/ATR-2026-01865
• https://github.com/microsoft/llmail-inject-challenge

Related threats