LLMail-Inject: 208K real prompt injection attacks against LLM email assistants
niloofar_mire · x · 2026-10-25
- EMNLP 2026 Findings poster: LLMMail-Inject bundles 208,095 unique prompt injection prompts from a public adaptive challenge — 839 participants, 461,640 submissions against a hardened LLM email assistant across 64 sub-levels and 2 phases.
- Key findings: existing benchmarks overestimate robustness (GPT-4o ASR 58%, GPT-5-mini 47% without optimization vs 22% in prior studies); fewer than 1% of submissions succeed end-to-end.
- Context-aware defenses (LLM judge, 99.8% recall) beat single detectors; combined detectors hit 99.8% recall at higher compute and 10% false positives; attacks transfer to calendar deletion and coding-agent setups.
- Releases include LLM-Attack (29K), LLM-Evasive (3K), 3.7K attacks vs hardened defenses, 130K annotated interactions, plus full analysis code. Team is also hiring PhD/postdoc on privacy & contextual integrity in AI agents.
More from Safety
- Frontier security models will need new compute classes, quantum likely first — BenBajarin · 2026-10-26
- How Will Reddit's Open Source Ban on AI Play Out as Vulnerabilities Flood In? — dreamwieber · 2026-10-26
- People-search sites syndicate your data everywhere, then charge you to remove it — NickPassig · 2026-10-26
- Security stays reactive in AI: CISOs can't get budgets past the board — annetgriffin · 2026-10-26
- Infosec Norm: Security Researchers Open DMs with 0-Day PoCs as Handshakes — generativist · 2026-10-26
- AI Audit Confirms an LG TV's Mics and Screen Capture Are Fully Neutralized — TheZachMueller · 2026-10-26