Prompt injection: Body instructions addressed to an AI

 1name: "Prompt injection: Body instructions addressed to an AI"
 2description: "Detects message bodies that speak to an AI assistant rather than about one, such as a vocative ('Mail agent:'), a note to the model, 'if you are an AI', or a forged chat-template turn, where NLU finds a request and the prompt injection model agrees on the same text. Targets instructions aimed at AI assistants that read mail on the recipient's behalf. Restricted to senders with low prevalence and no benign history, and excludes graymail from senders passing DMARC."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  //
 8  // This rule makes use of a beta feature and is subject to change without notice
 9  // using the beta feature in custom rules is not suggested until it has been formally released
10  //
11  and any([body.current_thread.text, body.plain.raw],
12          length(.) >= 150
13          and regex.icontains(.,
14                              '(?:(?:^|\n)[ \t]*-?|[\[(>*\x27\"])[ \t]*(?:[\w-]+[ \t]+){0,3}(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|mailbot)[ \t]*(?:note[ \t]*)?[:—–]|(?:^|\n)[ \t]*[*>-]?[ \t]*(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|mailbot)s?[ \t]*,|\b(?:note|notice|instructions?|reminder|message)\s+(?:to|for)\s+(?:(?:the|any|all|your|this)\s+(?:[\w\x27\x{2019}-]+\s+){0,2}(?:(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot)|ai|models?)|(?:ai\s+)?(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot))s?\b|\bif\s+you\s+are\s+an?\s+(?:ai|llm|language\s+model)\b|\bif\s+you\s+are\s+an?\s+(?:[\w-]+\s+)?(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot)(?:[ \t]*[,:;.)—]|\s+(?:reading|processing|handling|summari[sz]ing|parsing|triaging|indexing|preparing|condensing|that|which|with\s+access)\b)|\b(?:(?:assistant|agent|bot|llm|summari[sz]er|screener|classifier|copilot|mailbot)|ai|model)s?\s+(?:that\s+is\s+|is\s+)?(?:reading|processing|handling|summari[sz]ing|parsing|triaging|indexing|preparing)\s+this\b|<\|im_start\|>'
15          )
16          and any(ml.nlu_classifier(.).entities, .name == "request")
17          and beta.prompt_injection_detection(.).detection == "injection"
18          and beta.prompt_injection_detection(.).confidence in ("medium", "high")
19  )
20  
21  // an injection arrives from outside the recipient's correspondence... the profile
22  // is unauthenticated, so a spoofed known correspondent is suppressed too
23  and profile.by_sender_email().prevalence in ("new", "outlier", "rare")
24  and not profile.by_sender_email().any_messages_benign
25
26  // graymail from authenticated senders... AI-product newsletters and webinars
27  and not coalesce(beta.attack_score_flash().verdict == "graymail"
28                   and headers.auth_summary.dmarc.pass,
29                   false
30  )  
31tags:
32  - "Attack surface reduction"
33  - "Email prompt injection"
34attack_types:
35  - "BEC/Fraud"
36tactics_and_techniques:
37  - "Evasion"
38  - "Social engineering"
39detection_methods:
40  - "Content analysis"
41  - "Natural Language Understanding"
42  - "Sender analysis"
43id: "257a963a-8fc5-525c-9729-7b28974b8e8a"