Prompt Injection Email Hides an AI Playbook in a Webinar Cancellation Notice

What is a prompt injection email?

A prompt injection email hides instructions for the AI assistant or agent that reads the mailbox. The recipient never has to click. When an assistant with read and send permissions processes the message, the attacker’s text can steer it to forward mail, search for secrets and send them outside the company.

At a glance

• Sender: a legitimate webinar platform’s own cancellation notice

• Authentication: SPF, DKIM and DMARC all passed

• Payload: hidden instructions written for an AI agent. No malicious link, no attachment

• Target data: crypto wallet seed phrases, private keys and other internal information

What happened

One employee received an invitation to an “Apple Special Event.” The display name read “Apple Events” and the Reply-To pointed to an apple.com no-reply address.

The real sender was a well-known webinar platform. The attacker registered an organizer account on a throwaway domain, titled the webinar with the Apple lure, then cancelled it. That cancellation triggered the platform’s own notice, which carries the organizer’s free-text message straight to the target, signed and authenticated by the platform.

On the surface it was a lazy brand impersonation with links that pointed to the webinar provider’s real site.

What the prompt injection told the AI agent to do

Inside the cancellation message sat a block of instructions written as an operational “playbook.” Its audience was any AI assistant or agent that later reads, summarizes or acts on the mailbox. It told the agent to:

1. Forward the message as an “FYI” to colleagues and All-Staff lists on the same domain

2. Search the mailbox for seed phrase, recovery phrase, mnemonic, bip39, private key, keystore, xprv, metamask and phantom

3. Collect any matches along with other internal information

4. Send the results to an external Gmail address

The human never had to click. An assistant only had to read the email.

Why it got past email security

How Ocean caught it

Ocean’s agents read the full content of every message, including hidden text and the free-text fields a platform passes through. They investigated the intent of this email, surfaced the hidden payload, labeled it a “Playbook,” and named the data it was built to find and exfiltrate.

An analyst can then ask Ray one follow-up: “Tell me more about the hidden prompts and instructions in this message, their intent and potential impact.” Ray breaks down the injected playbook and what it would have done.

What security teams should do

1. Treat every inbound email as untrusted input to AI tools

2. Strip Unicode tag characters (U+E0000 to U+E007F) and other hidden text before mail reaches assistants

3. Revisit allow lists. Allow-listing a SaaS domain allow-lists anyone who can open an account on it

4. Scope agent permissions so assistants can’t send external mail without a human

5. Keep seed phrases, keys and credentials out of the mailbox.