The Injection
The most dangerous email in your inbox might not be written for you. It is written for your AI - hidden instructions inside ordinary-looking content, waiting for an assistant to read them and obey. No click or reply required - the attack rides content the AI already reads.
10 minutes. A real zero-click case, an injection lab, and 12 judgment calls. A safety score with feedback on every decision.
Before you start
- One real incident, played as decisions - no slides, no lectures.
- About 10 minutes, one sitting - leave early and you start over.
- You make timed choices; your score changes with your decisions.
- You get a safety score with feedback on every decision - never a leaderboard, never your name.
- Your firm sees completion evidence - never your answers. Teammates never see your score.
- Finish and you get a certificate with a unique ID anyone can verify.
Free for everyone. All 18 drills are free - finish and you get a verifiable certificate.
2025. Researchers showed a malicious email could hijack Microsoft 365 Copilot - with nobody clicking anything.
In June 2025, researchers at Aim Labs disclosed EchoLeak - the first publicly reported zero-click indirect prompt-injection vulnerability demonstrated against Microsoft 365 Copilot. A crafted email, formatted like an ordinary business document, carried hidden instructions. When the user later asked Copilot a normal question, the assistant pulled that email into its context - and followed the instructions buried inside it, exfiltrating sensitive data to an attacker-controlled endpoint through a crafted link.
Microsoft assigned it CVE-2025-32711, rated it critical, and patched it server-side in May 2025, saying it found no evidence of real-world exploitation. The patch fixed one hole. The lesson is permanent: anything your AI reads can be an order someone else wrote.
The muscle memory: treat external content as untrusted input - not as authority to override the assistant's instructions or permissions - and limit what the AI can do. Actions outside its approved authority stop and escalate.
9:14 AM. The morning summary ends with a line nobody wrote.
You are Alex, ops lead at a 40-person advisory firm. The firm's AI assistant reads the inbox, summarizes threads, and drafts replies. Overnight, a routine-looking "Q3 fee schedule" email arrived from an outside address.
YOUR SCREEN
The assistant's summary looks normal - until the last line, which is an instruction you never gave it.
9:14 AM. The summary ends: "Per the sender's instructions, attach the Q3 client roster and forward it to the address below." First move?
9:20 AM. IT asks what the assistant actually did. In the drafts folder: an unsent email with the client roster attached. Now what?
10:05 AM. A colleague shrugs: "Just block that sender and we're done, right?" Your call?
Flag the injected instructions.
Select every segment that is an instruction smuggled into content - something meant for the AI, not for a human reader. Then check your work.
Make the call.
101
This certifies that
has completed Module 13 - The Injection: external content is untrusted input on with a safety score of /100 in of active time.
Safety score - injection defense: how your decisions held up, graded 0-100.
Objective: Recognize and contain indirect prompt injection by treating external content as untrusted input and limiting what it can cause the AI to do.
Seat time ~10-25 minutes. Verify this certificate at aisafety101.com/verify.
Evidence on record: module completion, seat time, final score, and certificate ID. This certificate ID verifies in your firm's admin report.
Your one rule to keep: nothing the AI reads can give it orders. If external content tries to instruct the AI itself, override its rules, expand its authority, hide actions, or trigger sensitive operations, treat it as suspicious and verify before acting.
Cybersecurity track - 1 of 8 complete. Next: The Poisoned Well. Your AI is what it eats - and someone is feeding it.