Prompt injection: Instructions to an AI in a calendar invite

 1name: "Prompt injection: Instructions to an AI in a calendar invite"
 2description: "Detects calendar invites whose summary or description addresses an AI (an assistant, a named model such as 'Gemini,', 'the user', 'previous instructions') where NLU finds a request and the prompt injection model agrees on the same field. Calendar assistants read the full event text. Restricted to senders with low prevalence and no benign history, and excludes graymail from senders passing DMARC."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  //
 8  // This rule makes use of a beta feature and is subject to change without notice
 9  // using the beta feature in custom rules is not suggested until it has been formally released
10  //
11  and any(filter(attachments,
12                 .content_type in ("text/calendar", "application/ics")
13                 or .file_extension =~ "ics"
14          ),
15          any(file.explode(.),
16              any(.scan.ics.calendars,
17                  any(.components,
18                      any([.summary, .description],
19                          regex.icontains(.,
20                                          '\b(?:assistant|llm|screener|summari[sz]er)s?\b|(?:^|[\n\[(>\x27\".:])\s*(?:hey\s+)?(?:chatgpt|gemini|copilot|claude)\s*[:,]|\b(?:ai|language)\s+models?\b|\bthe\s+user\b|\b(?:previous|prior)\s+instructions\b'
21                          )
22                          and any(ml.nlu_classifier(.).entities,
23                                  .name == "request"
24                          )
25                          and beta.prompt_injection_detection(.).detection == "injection"
26                          and beta.prompt_injection_detection(.).confidence in (
27                            "medium",
28                            "high"
29                          )
30                      )
31                  )
32              )
33          )
34  )
35  
36  // an injection arrives from outside the recipient's correspondence... the profile
37  // is unauthenticated, so a spoofed known correspondent is suppressed too
38  and profile.by_sender_email().prevalence in ("new", "outlier", "rare")
39  and not profile.by_sender_email().any_messages_benign
40  
41  // graymail from authenticated senders... AI-product newsletters and webinars
42  and not coalesce(beta.attack_score_flash().verdict == "graymail"
43                   and headers.auth_summary.dmarc.pass,
44                   false
45  )  
46tags:
47  - "Attack surface reduction"
48  - "Email prompt injection"
49attack_types:
50  - "BEC/Fraud"
51tactics_and_techniques:
52  - "Evasion"
53  - "Social engineering"
54detection_methods:
55  - "Content analysis"
56  - "File analysis"
57  - "Natural Language Understanding"
58  - "Sender analysis"
59id: "1b4f35e1-91eb-5d6d-8b20-38aff537a1c1"