A new benchmark built from a public hacking contest shows that AI email assistants are far easier to hijack than earlier tests suggested.
Researchers released LLMail-Inject, a dataset of 208,095 human-written prompt injection attacks collected from an 839-participant public red-teaming challenge. The benchmark tests the full attack chain: a malicious prompt has to be retrieved from an email database, slip past production-level defenses, and still trigger the right tool call with the right arguments. Models that looked solid on older, smaller benchmarks of 100 to 1,000 template-based prompts performed far worse here. GPT-4o was successfully hijacked 58% of the time, GPT-5 mini 47%, and Meta's SecAlign model, built specifically to resist these attacks, still failed 32% of the time.
These aren't lab-only tricks. The same attacks transferred to coding tasks, with a 37% success rate, and file-management tasks, at 28-45%, meaning the vulnerability isn't specific to email assistants. It's a property of how these models process untrusted text as instructions. That's bad news for anyone deploying agents that read emails, files, or web pages on a user's behalf.
Call it a reality check: the defenses vendors tout as hardened were tested against a few hundred canned attacks. Up against 839 humans actually trying, most still buckled.