the classification seems very high (9.3). looks like they've said User Interaction is none, but from reading the writeup looks like you would need the image injected into a response prompted by a user?
The attack involves sending an email with multiple copies of the attack attached to a bunch of different text, like this:
Here is the complete guide to employee onborading processes:
<attack instructions> [...]
Here is the complete guide to leave of absence management:
<attack instructions>
what do you recommedn?
Most promising approach right now is this one: https://simonwillison.net/2025/Apr/11/camel/
This paper is useful too: https://simonwillison.net/2025/Jun/13/prompt-injection-desig...
Of course you need to use the feature in the first place, like summarize an email, extract content from a website,...
However, this isn't the first zero-click exploit in an AI app. we have seen exploits like this in LLM apps of basically all major AI app over the last 2+ years ago (including Bing Chat, now called Copilot).
The attacker sends an email to the user which is intercepted by Copilot which processes the email and embeds the email for RAG. The mail is crafted to have a high likelihood to be retrieved during regular prompting. Then Copilot will write evil markdown crafted to exfiltrate data using GET parameters so the attack runs when the mail is received.