If you're interested in this kind of thing, I took part in a CTF last year organised by Microsoft that was about this exact kind of email injection, with differ

If you're interested in this kind of thing, I took part in a CTF last year organised by Microsoft that was about this exact kind of email injection, with different levels of protection They published the attempts dataset [0] as well as a paper [1] afterwards [0]: https://huggingface.co/datasets/microsoft/llmail-inject-challenge https://huggingface.co/datasets/microsoft/llmail-inject-chal... [1]: https://arxiv.org/abs/2506.09956 https://arxiv.org/abs/2506.09956