I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.
Yes. It can read email.
And it was expired!
And I was happy. And some time passed - and I realized it had read my .env file and performed operations on my API keys.
That these models do all this stuff already makes me assume any skill take over is simply trivial.
Or if it has access to a tool call which allows it to exfiltrate data.
In the example identified, the AI agent never accesses the exfiltration URL.
The agent sends an innocuous-looking message to a user via a teams message.
MSTeams previews the link, accessing the exfiltration URL.
Can we stop the apologetic framing? It's increasingly common to create exploits from multiple vulnerabilities. Each one is bad. Downloading corporate malware is stupid. Adding random prompt injection is reckless. Insane to run autonomous agents on top of it.
Prompt injection is more serious in this regard, because there is no known solid protection. All the other problems are failure in process, prompt injection is failure at the first thought.