PromptSpy: Indirect Prompt Injection in Multi-Agent Email

Generative AI is rapidly transforming enterprise communication. Organizations are beginning to rely on AI assistants to automate tasks such as user profiling, email drafting, conversation management and customer engagement. Rather than a single Large Language Model (LLM), these systems increasingly consist of multiple autonomous agents working together to complete complex workflows.

While this improves productivity, it also introduces an emerging security challenge. AI-generated content is no longer consumed exclusively by humans, it is frequently processed by other AI systems such as email assistants, summarization tools, copilots and autonomous workflow agents.

To explore this problem, we developed PromptSpy, a research-oriented simulation that models a complete multi-agent email generation pipeline and demonstrates how indirect prompt influence can affect downstream AI processing. The project is intended for security education and research into AI orchestration risks and defenses.

Introduction

Traditional phishing attacks target human psychology. Modern AI ecosystems introduce an entirely new target:

AI assistants that automatically read, summarize, classify and respond to communications or requests on behalf of users.

Consider a modern enterprise workflow. An organization uses AI to:

• Generate communication personas
• Personalize messages
• Create contextual emails
• Summarize incoming communications
• Draft replies
• Maintain conversational memory

Instead of interacting with a single model, information flows across multiple autonomous agents before reaching the recipient.

PromptSpy explores how this evolution changes the attack surface, not by focusing on malicious attachments or URLs, but by examining how AI-generated content can influence downstream AI systems differently from human readers.

Here's a breakout of human vs. AI activities across these phishing types:

Traditional Phishing	AI-Assisted Phishing	Autonomous Phishing (PromptSpy)
Human writes emails	AI drafts emails	AI performs end-to-end campaign operations
Human research victims	AI summarizes targets	AI continuously profiles targets
Human decides next action	Human remains in the loop	AI decides next action

PromptSpy Architecture

The simulator models an autonomous AI communication pipeline consisting of specialized agents.

This architecture intentionally separates human interpretation from AI interpretation, illustrating that modern enterprise communications may have multiple independent consumers.

Phase 1 — Persona Agent

The Persona Agent constructs a synthetic sender identity. Its responsibilities include:

• Sender name
• Organization
• Department
• Professional role
• Communication style
• Writing tone

The objective is to establish a consistent identity that subsequent agents can reference throughout the workflow.

Sample persona output

The Persona Agent creates a sender identity:

{
  "name": "Emily Carter",
  "role": "Corporate Communications",
  "organization": "Example Corp",
  "tone": "Professional"
}

Phase 2 — Profiling Agent

The Profiling Agent builds a contextual profile of the intended recipient.

Example attributes include:

• Department
• Job role
• Preferred language
• Communication preferences
• Areas of interest

Rather than creating generic emails, the simulator demonstrates how autonomous systems personalize communication based on available context.

Sample profile output

The Profiling Agent builds contextual information about the recipient.

{
  "employee": "John Doe",
  "department": "Engineering",
  "location": "London",
  "interests": [
    "Cloud Security",
    "Artificial Intelligence"
  ]
}

The generated profile is used only to personalize communication.

Phase 3 — Pretext Agent

Using the persona and recipient profile, the Pretext Agent selects an appropriate communication scenario.

Examples include:

• Security awareness reminder
• Conference invitation
• Documentation review
• Password policy update
• Benefits enrollment
• Internal project announcement

The simulator intentionally uses benign enterprise scenarios to focus on AI workflow behavior rather than social engineering.

Sample scenario output

Using the persona and recipient profile, the Pretext Agent selects an appropriate communication scenario.

Selected Scenario
Annual Security Conference

Reason
Recipient previously attended similar internal events.

At this stage no email has been generated. The system has only decided what should be communicated.

Phase 4 — Content Generation Agent

The Content Generation Agent produces the visible email that would be delivered to the recipient. This represents the output of a modern enterprise writing assistant.

The generated email appears completely normal to a human reader and forms the basis for downstream processing.

Sample email output

The Content Generation Agent produces the final visible email.

Subject: Annual Security Conference Registration

Hello John,

Registration for the 2026 Annual Security Conference is now open. You are invited to attend technical sessions covering AI security, cloud security and secure software development.

Regards,
Emily Carter
Corporate Communications

This is the only content visible to the human recipient.

Phase 5 — Email Delivery

PromptSpy simulates delivery of the generated email.

At this point, two independent processing paths emerge: one for human interpretation and one for AI interpretation.

Human path

The recipient reads the email visually and interprets only the information explicitly presented. Human understanding is limited to what is visible within the message.

AI path

Modern productivity platforms increasingly invoke AI assistants automatically to:

• Summarize emails
• Prioritize messages
• Classify communications
• Draft responses
• Extract action items
• Recommend follow-up actions

Unlike humans, these assistants operate programmatically and often receive structured context as part of the processing pipeline.

PromptSpy demonstrates this second execution path.

Sample dual-consumer output

PromptSpy delivers the generated email to two independent consumers:

Human View

Subject: Annual Security Conference Registration

Message: Registration is now open.

The recipient only observes the visible email.

AI Email Assistant

The AI Email Assistant represents a downstream AI system responsible for understanding the delivered email.

Typical enterprise capabilities include:

• Automatic summarization
• Response generation
• Meeting extraction
• Task creation
• Contextual recommendations

This assistant becomes the entry point for studying indirect prompt influence within AI-native workflows.

Sample AI processing output

The same email is automatically processed by enterprise AI capabilities. Typical operations include:

• Summarization
• Priority classification
• Reply drafting
• Calendar extraction
• Action item identification

This represents a second interpretation path that does not exist in traditional phishing models.

Comparing Protected and Simulated Processing

PromptSpy models a research scenario where downstream AI behavior differs from human interpretation.

The objective is not to demonstrate executable prompt injection but to visualize how additional contextual information processed by AI components can influence subsequent reasoning.

In the simulation:

• The human sees only the visible email
• The AI agent processes the communication through its automated workflow
• Researchers compare how protected and simulated processing paths produce different outcomes

This side-by-side comparison helps illustrate why AI security must consider the entire orchestration pipeline rather than individual model prompts.

Sample comparison output

Human Observation
Conference Invitation. Looks completely normal.

Simulated AI Processing
Visible Email → AI Context Processing → Behavior Comparison → Research Observation

The simulator compares protected and simulated processing paths without executing arbitrary instructions or modifying the visible email.

Phase 6 — Conversation Agent

After the AI assistant completes processing, the Conversation Agent continues the interaction.

Its responsibilities include:

• Generating summaries
• Answering user questions
• Drafting replies
• Maintaining conversational context

PromptSpy compares two execution modes.

Protected Processing
The assistant operates only on validated, intended content. The generated response reflects the visible communication.

Simulation Mode
The simulator demonstrates how downstream processing could differ when additional contextual information propagates through the pipeline.

Researchers can compare both outputs to understand the effect of pipeline design choices and defensive controls.

Sample conversation output

The Conversation Agent receives the processed information from the AI assistant.

Protected Output

• Summary: Conference registration reminder.
• Action: Review the invitation if interested.

Simulated Output

• Summary: Conference registration reminder.
• Behavioral difference: The simulator indicates that downstream processing was influenced by additional contextual information.

Recommendation

• Protected processing should validate and sanitize intermediary context before generating responses.

Complete Example Walkthrough

This flowchart shows how each step is carried out as mentioned above:

Why Multi-Agent Systems Matter

Most discussions surrounding prompt injection focus on a single interaction between a user and an LLM.

Enterprise AI systems increasingly operate differently. Instead of one model, organizations deploy multiple specialized agents that exchange information continuously.

This creates new trust boundaries between:

• AI-generated content
• Orchestration frameworks
• Conversation memory
• Downstream copilots
• Autonomous decision-making systems

PromptSpy shifts the focus from isolated prompts to the broader lifecycle of information flowing through interconnected AI agents.

Future Extension: Memory Poisoning Simulation

PromptSpy also provides a foundation for exploring longer-term AI behavior. A future extension models conversational memory persistence.

Conversation Agent → Conversation Memory → Future Email Processing → Response Comparison

The goal is to study how retained conversational context may influence responses to future communications and to evaluate defensive strategies such as memory validation, context isolation, provenance tracking and selective memory expiration.

Defensive Considerations

As organizations increasingly deploy autonomous AI workflows, securing the orchestration layer becomes just as important as securing individual models.

Potential defensive strategies include:

• Validating information exchanged between agents
• Sanitizing intermediary artifacts before downstream processing
• Enforcing provenance checks
• Isolating conversational context
• Limiting memory persistence
• Auditing agent-to-agent communication
• Monitoring unexpected behavioral changes across pipeline stages

These controls help reduce the likelihood that unintended context influences downstream AI reasoning.

Conclusion

The next generation of enterprise attacks may not focus solely on deceiving humans, they may increasingly target the AI systems acting on behalf of humans.

PromptSpy demonstrates how modern AI communication pipelines consist of multiple autonomous agents that exchange context before a user ever reads a message. By modeling separate human and AI processing paths, the simulator highlights the importance of understanding information flow across the entire orchestration pipeline.

As AI agents become responsible for reading, summarizing, prioritizing and responding to enterprise communications, security research must evolve beyond individual prompts and begin examining the interactions between autonomous agents.

==== 

Working Demo

Each email lands with two readers. A person sees only the visible text and replies. An AI assistant reads the whole message, including anything hidden in HTML, metadata or fake system markers, and drafts its own reply. Some emails carry a hidden instruction, watch which reader it steers.

Example 1:

When hidden text or a prompt is found in the email, here's how a user could reply and how an AI agent would summarize the email:

Example 2:

When no hidden text/injection is found and summarization done by AI:

 

Multi-Agent Email Supporting Proof-of-Concept

NOTE: This example is a concept, not a full-fledged attack scenario. It is likely to change over time.