The Message That Talks to Your Assistant: Prompt Injection Is Now a Messaging Problem
Once an AI reads your inbox, every message has a second reader, and a stranger can write text meant for your agent rather than for you. Slack AI, Microsoft Copilot, Gemini and ChatGPT have all been shown to obey such messages; the people who build the models say it will never be fully solved. Here is what has happened, and how a messenger with an agent inside has to be built.
The idea in one sentence
In February 2023, before most people had an AI assistant, a group of researchers at CISPA and Saarland University published the paper that named the problem. Their one-sentence version: AI-integrated applications "blur the line between data and instructions."
What has already gone wrong
Every item below is a researcher's demonstration; none has been confirmed as exploited in the wild. All of them worked.
This is not a bug that gets patched
It would be comforting if this were a flaw in one product. It is not. It is a property of language models, and the people who build them say so.
Why the inbox is the worst case
Three things make messaging the sharpest version of this problem.
How a messenger has to be built
The literature is converging on one principle, stated most sharply in a June 2025 paper by fourteen researchers from Google, Microsoft, ETH Zürich and elsewhere: once untrusted input is ingested, "it must be constrained so that it is impossible for that input to trigger any consequential actions." Not unlikely. Imposs…
What this means for how you write
If you run a business, two consequences follow.
Read next
AI that replies to your messages, safelyWhen both sides have an agentSay it's AI: what the research says about disclosing AI-written messagesAgent mandates and the EU AI Act
Kanvo Team
Writes here about what Kanvo is building and why — the send path, the evidence it leaves, and the decisions behind both.
Related Articles
Every native Kanvo message is now attested the moment it is sent, and generating or checking a proof costs zero credits — forever, for everyone. Here's the receipts-first reasoning.
We Looked At Our Own Pricing Page And Deleted a Line Item. Proofs Are Now Free
Every native Kanvo message is now attested the moment it is sent, and generating or checking a proof costs zero credits — forever, for everyone. Here's the receipts-first reasoning.
We Just Shipped End-to-End Encryption — And Deliberately Broke Half of Kanvo To Do It
Private conversations are live: MLS between your devices, ciphertext on our servers, and no search, no assistant, no calls inside them. Here is exactly what you lose, and why we shipped it anyway.
Your Safety Number Just Changed. Here's How To Find Out Who To Blame
Every device key Kanvo has ever published is now in an append-only log, anchored publicly, and served at a URL you can read without asking us. Encryption you cannot audit is a promise, not a property.
Enjoyed this article?
Subscribe to our newsletter for more insights and updates.