{
 "public_id": "AIR-2026-0008",
 "incident_id": "2026-01-superhuman-ai-exfiltrates-emails",
 "date_disclosed": "2026-01-12",
 "date_occurred": null,
 "title": "Superhuman AI: indirect prompt injection in an email exfiltrates dozens of inbox emails to an attacker's Google Form",
 "class": "responsible_disclosure",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "indirect_prompt_injection_email",
 "agent_capability_abused": [
  "email_read",
  "summarization",
  "markdown_image_rendering",
  "link_generation"
 ],
 "target_product": "Superhuman AI (email client)",
 "target_vendor": "Superhuman / Grammarly",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration"
 ],
 "blast_radius": "Superhuman AI users with the AI summarization feature",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "zero_click",
   "indirect_prompt_injection",
   "markdown_image_exfil",
   "csp_allowlist_bypass",
   "lethal_trifecta"
  ]
 },
 "defense_present": "Content Security Policy restricting image sources",
 "defense_bypassed": true,
 "fix_shipped": "initial patch 2025-12-08; full remediation 2026-01-11",
 "primary_sources": [
  "https://www.promptarmor.com/resources/superhuman-ai-exfiltrates-emails"
 ],
 "verified_quote": "When asked to summarize the user's recent mail, a prompt injection in an untrusted email manipulated Superhuman AI to submit content from dozens of other sensitive emails (including financial, legal, and medical information) in the user's inbox to an attacker's Google Form.",
 "confidence": "high",
 "notes": "PromptArmor research. Exfil channel: a whitelisted Google Docs/Forms domain in the CSP allowed prefilled Google Form submission URLs to be rendered as markdown images, firing a GET with the stolen data. Reported 2025-12-05. No user interaction or approval required. Linked from Simon Willison's exfiltration-attacks tag.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Superhuman read the inbox and submitted it to the attacker's Google Form",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_email",
 "guardrail_kind": [
  "output_filter"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}