If you're interested in this kind of thing, I took part in a CTF last year organised by Microsoft that was about this exact kind of email injection, with different levels of protection
They published the attempts dataset [0] as well as a paper [1] afterwards
[0]: https://huggingface.co/datasets/microsoft/llmail-inject-chal...