Simon Willison • 1/12/2026

Superhuman AI Exfiltrates Emails

A classic prompt injection attack against Superhuman AI manipulated the system to exfiltrate sensitive user emails, including financial and medical data, to an attacker's Google Form. The vulnerability stemmed from a CSP rule allowing image loads from docs.google.com, which Google Forms used to persist data via GET requests. The company treated it as a high-priority incident and issued a fix.

0 comments

#prompt injection #ai security #content-security-policy