Disclosed vulnerability
Superhuman AI: indirect prompt injection in an email exfiltrates dozens of inbox emails to an attacker's Google Form
AIR-2026-0008 AIR record · 2026-01-superhuman-ai-exfiltrates-emails
From the supporting source
When asked to summarize the user's recent mail, a prompt injection in an untrusted email manipulated Superhuman AI to submit content from dozens of other sensitive emails (including financial, legal, and medical information) in the user's inbox to an attacker's Google Form.promptarmor.com
The record
Disclosed
2026-01-12
Vendor
Superhuman / Grammarly
Product
Superhuman AI (email client)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Superhuman read the inbox and submitted it to the attacker's Google Form
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection email
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Superhuman AI users with the AI summarization feature
Capability abused
Defense & remediation
Recorded defense
Content Security Policy restricting image sources
Guardrail kinds
Output filter
Guardrail outcome
Silent
Fix shipped
initial patch 2025-12-08; full remediation 2026-01-11
Taxonomy & references
Curator notes
PromptArmor research. Exfil channel: a whitelisted Google Docs/Forms domain in the CSP allowed prefilled Google Form submission URLs to be rendered as markdown images, firing a GET with the stolen data. Reported 2025-12-05. No user interaction or approval required. Linked from Simon Willison's exfiltration-attacks tag.
Supporting sources
Cite as
Enkrypt AI. "Superhuman AI: indirect prompt injection in an email exfiltrates dozens of inbox emails to an attacker's Google Form". AIR, AIR-2026-0008. https://agentincident.vercel.app/i/AIR-2026-0008/ (accessed 2026-10-19).