GigaMail ships three MCP security patches against indirect prompt injection leaks
Soft-Lie-434 · reddit · 2026-10-26
The GigaMail developer details how mail-based prompt injection risks change when the app is exposed as an MCP server to external agents (Hermes, OpenClaw, API-backed agents) that also hold shell, file and network tools.
- PR #26 (merged): executable attachments are never handed to agents over MCP—replaced with name/size/SHA-256 notes; released only via console click or OS biometric prompt
- PR #27 (open): agents see only visible HTML text; CSS-hidden content and invisible Unicode are stripped, and unevaluable HTML withholds the body entirely
- PR #28 (open): Telegram link previews disabled on approval drafts, blocking EchoLeak-style exfiltration where a hidden instruction embeds attacker.example/?d=<data> in a reply
A practical writeup of hardening MCP-exposed mail against indirect prompt injection, with the author asking the community for missed attack surfaces.
More from coding & agent
- Traks: free MIT-licensed self-hosted analytics on Cloudflare with an MCP server for agents — moeinteractive · 2026-10-26
- AI adoption up to 78% but developer trust down to 33%, Stack Overflow surveys show — agh_murad · 2026-10-26
- Arize's Aparna Dhinakaran on the AI engineer's new job: running factories of agents — AI Engineer · 2026-10-26
- Open-source AI design skills for Claude Code and Cursor earn 5.1k stars — moeinteractive · 2026-10-26
- RExBench: best coding agent solves only 33% of autonomous research extension tasks — najoungkim · 2026-10-26
- Remotion ships official Agent Skills for Claude Code, Codex and Cursor — lmoroney · 2026-10-26