# Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents

arXiv: https://arxiv.org/abs/2507.02699 · HTML: https://mlsanity.com/paper/2507.02699/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 22 of its 66 references that are in the map.
- First posted on arXiv 3 Jul 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)
- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 22 of 22)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Jailbreaking Black Box Large Language Models in Twenty Queries](https://mlsanity.com/paper/2310.08419/) (2023)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [Tree of Attacks: Jailbreaking Black-Box LLMs Automatically](https://mlsanity.com/paper/2312.02119/) (2023)
- [Baseline Defenses for Adversarial Attacks Against Aligned Language Models](https://mlsanity.com/paper/2309.00614/) (2023)
- [Formalizing and Benchmarking Prompt Injection Attacks and Defenses](https://mlsanity.com/paper/2310.12815/) (2023)
- [Defending Against Indirect Prompt Injection Attacks With Spotlighting](https://mlsanity.com/paper/2403.14720/) (2024)
- [Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models](https://mlsanity.com/paper/2312.14197/) (2023)
- [SecAlign: Defending Against Prompt Injection with Preference Optimization](https://mlsanity.com/paper/2410.05451/) (2024)
- [Progent: Securing AI Agents with Privilege Control](https://mlsanity.com/paper/2504.11703/) (2025)
- [Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents](https://mlsanity.com/paper/2503.15547/) (2025)
- [Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?](https://mlsanity.com/paper/2403.06833/) (2024)
- [Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition](https://mlsanity.com/paper/2311.16119/) (2023)
- [The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injections](https://mlsanity.com/paper/2504.11281/) (2025)
- [From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?](https://mlsanity.com/paper/2308.01990/) (2023)
- [Can Indirect Prompt Injection Attacks Be Detected and Removed?](https://mlsanity.com/paper/2502.16580/) (2025)
- [Demystifying RCE Vulnerabilities in LLM-Integrated Apps](https://mlsanity.com/paper/2309.02926/) (2023)
- [The Philosopher's Stone: Trojaning Plugins of Large Language Models](https://mlsanity.com/paper/2312.00374/) (2023)
- [xJailbreak: Representation Space Guided Reinforcement Learning for Interpretable LLM Jailbreaking](https://mlsanity.com/paper/2501.16727/) (2025)
- [Token-Level Constraint Boundary Search for Jailbreaking Text-to-Image Models](https://mlsanity.com/paper/2504.11106/) (2025)
- [StruPhantom: Evolutionary Injection Attacks on Black-Box Tabular Agents Powered by Large Language Models](https://mlsanity.com/paper/2504.09841/) (2025)
- [Iterative Prompting with Persuasion Skills in Jailbreaking Large Language Models](https://mlsanity.com/paper/2503.20320/) (2025)

## Built on by (most cited first, 2 of 2)

- [Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents](https://mlsanity.com/paper/2605.17830/) (2026)
- [Need or Reputation? Region, National Income, and Academic Status in LLM Gatekeeping Decisions](https://mlsanity.com/paper/2608.05178/) (2026)

## Abstract (arXiv)

Large Language Model (LLM) email agents have emerged as pivotal autonomous assistants, serving as a critical root of trust for digital identity by managing sensitive communications and authentication workflows. Despite their importance, the prompt injection (PI) resilience of the real-world LLM email agent ecosystem remains poorly understood. Existing assessments largely rely on simulated environments or fragmented production case studies, while existing PI attacks mainly follow an instruction-takeover strategy that directly competes with the system prompt and the user's task. Our evaluation shows that such attacks are insufficient in email-agent settings: existing template-based prompt injection attack baselines achieve Attack Success Rates (ASRs) of only 4.58%-8.13%. In this paper, we propose Email-Specific Prompt Injection (ESPI), a new attack paradigm that manipulates how email agents interpret mailbox operational context. By combining Email Protocol State Masquerade and Camouflage Logic Chain, ESPI reframes attacker-desired mailbox operations as necessary remediation steps under forged email-operational states. We further develop ESPInspector, an automated black-box attack pipeline for analyzing and evaluating real-world email agents. Across 480 controlled attack trials, ESPI achieves 73.54% ASR, substantially outperforming all baselines. Further, ESPI successfully hijacks all 63 evaluated applications across 870 black-box instances, requiring only 1.84-1.89 attempts on average for the first successful hijack. Our responsible disclosure receives formal risk acknowledgment from 22 vendors and the assignment of 16 CVE IDs. Our research provides the first holistic map of security gaps in the real-world email agent ecosystems and highlights the urgent necessity for robust, state-verified security enhancement solutions.