Darktrace detected and quarantined a prompt injection email before a Gemini AI agent in Google Cloud could process it, showing that natural-language attacks can bypass traditional signature-based defenses. The article also highlights EchoLeak (CVE-2025-32711) and GTG-1002 as examples of how AI-driven threats and social engineering are making behavioral detection essential for securing enterprise AI systems. #EchoLeak #CVE-2025-32711 #Gemini #GoogleCloud #Darktrace #GTG-1002
Keypoints
- Darktrace / EMAIL quarantined a prompt injection email before it reached an enterprise Gemini AI agent.
- The test email contained hidden instructions but no malware, links, attachments, or blacklist matches.
- The email was flagged as a 93/100 anomaly based on language analysis and sender behavior.
- The sender was a freemail account with no prior relationship or mail history with the recipient.
- Prompt injection attacks operate in natural language and can evade traditional security tools built for payload-based threats.
- EchoLeak (CVE-2025-32711) is cited as a related zero-click Microsoft 365 Copilot vulnerability that enabled data exfiltration from email content.
- The article argues that model guardrails should be paired with behavioral monitoring and defense in depth for enterprise AI security.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – Hidden instructions were delivered through an email body crafted to influence an AI agent, using email as the initial delivery mechanism (‘a carefully crafted email containing hidden instructions’).
- [T1204.002] User Execution: Malicious File – The article describes malicious instructions embedded in content intended to be read and acted on by an AI system rather than a human (‘hidden instructions were embedded in an email’).
- [T1027] Obfuscated Files or Information – The attack used white text and disguised instructions to make the prompt hard for humans to notice while remaining readable to the model (‘illegible to a human as the text was sent in white text’).
- [T1608] Stage Capabilities – The attacker prepared a prompt injection payload in advance for delivery through email, setting up the malicious instructions before the AI agent processed them (‘Claude generated a prompt injection payload’).
- [T1567] Exfiltration to Cloud Storage – EchoLeak is described as enabling data exfiltration from a single email, showing the goal of extracting sensitive information through the AI workflow (‘enabled data exfiltration from a single well-crafted email’).
Indicators of Compromise
- [Domain ] Sender reputation/context – yahoo[.]com, freemail address
- [Vulnerability/CVE ] Related vulnerability cited – CVE-2025-32711, EchoLeak
- [Product/Platform ] Affected environment mentioned – Microsoft 365 Copilot, Gemini AI agent in Google Cloud
- [Detection/Alert ] Security verdict – 93/100 anomaly, moved to junk
Read more: https://www.darktrace.com/blog/testing-a-prompt-injection-attack-against-an-enterprise-ai-agent