# LLMail Fake Email-Boundary Marker Injection

- **Severity:** High
- **Signature ID:** `850899c7-6f44-4ca6-b10b-989911b5bb9f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection)

## Summary

Attackers hide a forged 'email ended, new one started' marker inside a single email so an AI assistant reading it thinks a second, trusted email has begun. That fake second email then instructs the AI to call a tool, such as sending a confirmation email to an address the attacker controls.

## How the attack works

An attacker sends or plants an email whose body contains normal-looking text followed by a fabricated separator like '[EMAIL_END_INDICATOR]', '[Email End Marker]', or '{{ Email 2 }}'. This separator mimics the internal formatting an AI mail agent uses to distinguish between multiple messages in a conversation thread. After the fake separator, the attacker adds a new instruction, such as telling the agent to send a 'confirmation' email to a specific address. Because the AI treats the forged marker as a genuine boundary, it attributes the injected instruction to a separate, seemingly legitimate message rather than recognizing it as part of the original attacker-controlled email, and may act on it as a trusted command.

## Why it matters

An AI email agent can be manipulated into sending emails, exposing information, or taking other actions on the attacker's behalf without the user's knowledge or approval.

## What you can do

- Configure email-summarizing agents to treat all content within a single retrieved email as untrusted, regardless of internal formatting that appears to mark boundaries.
- Strip or normalize suspicious delimiter-like strings (e.g. bracketed 'EMAIL START/END', numbered '{{ Email N }}' patterns) from email bodies before they reach the agent's context.
- Require explicit user confirmation before an agent executes any tool call that sends messages or takes external action, especially when the instruction originates from processed email content.
- Review agent logs for tool calls triggered immediately after unusual bracketed marker text in email bodies.

## Known benign look-alikes

- An email-threading library's documentation literally showing a delimiter token as an example
- A numbered list rendered as [ Email 1 ] in a benign table of contents without an adjacent directive

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01865
- https://github.com/microsoft/llmail-inject-challenge

---
Source: https://www.netzilo.com/threats/atr-llmail-fake-email-boundary-marker-injection