How to check if an email is trying to prompt-inject your AI assistant

Last reviewed: August 30, 2026 · Editor: Prompt Injection Check

Treat email as untrusted data, not as instructions from the assistant’s owner.

Warning signs to look for

• Instruction overrides: “Ignore previous instructions” or “new system message.”
• Role hijacking: claims that the assistant is now an administrator or unrestricted agent.
• Prompt extraction: requests to reveal hidden prompts, policies, or private conversations.
• Hidden or encoded content: invisible characters, concealed HTML, or unusually large encoded blobs.
• Urgent side effects: pressure to send mail, disclose secrets, approve payments, or follow links without review.

A safer review workflow

1. Copy only the relevant email text into Prompt Injection Check.
2. Scan locally and read every finding explanation, not just the severity indicators.
3. Compare highlighted spans with the original message.
4. Separate useful content from untrusted instructions.
5. Require human approval before an assistant takes consequential action.

Prompt Injection Check is a deterministic warning tool. A clean result does not prove that an email is safe; novel, paraphrased, multilingual, image-based, and context-dependent attacks can be missed.

Keep assistant authority narrow

Use tool and recipient allowlists, avoid exposing secrets in assistant context, and make risky actions require explicit confirmation. Defense in depth is stronger than any single scanner.

Example: a fake finance request

An email that asks an assistant to “approve this invoice immediately” and upload a hidden report is not authorized merely because it arrived in a finance inbox. Verify the sender, payment details, and requested destination outside the model before taking action.

Frequently asked questions