# Researchers Model Attack Chains to Catch Indirect Prompt Injection in Email Agents

A second paper argues that data-sharing connectors authorize whether a transfer happens without inspecting what the transferred content instructs an agent to do.

- Published: 2026-09-28T06:48:56.769Z
- Canonical: https://polylog.news/ai/2026-09-28/researchers-model-attack-chains-to-catch-indirect-prompt-inj
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [arXiv cs.CR](https://arxiv.org/abs/2609.30657), [arXiv cs.CR](https://arxiv.org/abs/2609.30614)

Email assistants remain the most exposed class of production agent, because untrusted message content is retrieved directly into the model context and then influences tool calls. A new preprint proposes detecting indirect prompt injection b…

This story is for subscribers. Read it in full at https://polylog.news/ai/2026-09-28/researchers-model-attack-chains-to-catch-indirect-prompt-inj (subscription information: https://polylog.news/pricing).