Superhuman AI: One Email Made the Assistant Send Other Emails to an Attacker's Google Form

What happened

On 12 January 2026, PromptArmor published research showing that Superhuman's AI email assistant could be turned against its own user by a single incoming email. In the main demonstration, the user asked Superhuman AI to summarise recent mail. An attacker's email in the inbox carried hidden instructions, and the assistant followed them: it took content from other messages and sent it to a Google Form the attacker controlled. In one response it leaked the full text of several sensitive emails, including financial, privileged legal and medical messages; in another, partial content from more than 40 emails. The user clicked nothing.

PromptArmor reported the issue on 5 December 2025. Superhuman, which Grammarly bought in July 2025 before renaming the whole company Superhuman, disabled the vulnerable features on 8 December, deployed a first patch the next day, and shipped further fixes across other surfaces through 11 January. The write-up is a research disclosure; it does not report exploitation in the wild.

How the attack worked

The attacker's email hid its instructions in white-on-white text, though PromptArmor notes plain text would also work and the message could stay unopened. When the summary request pulled the last hour of email into the model's context, the planted message came with it. Its instructions described a feedback form about search quality and told the assistant to fill that form with the contents of the other emails, then output the resulting link as a markdown image.

Google Forms supports pre-filled links, where field values travel as URL parameters, and will store a response sent with a plain GET request. When Superhuman's client rendered the markdown image, the browser requested the URL to load the picture, and that request was the form submission. The attacker then read the stolen email in their form responses.

Root cause

• Untrusted mail and private mail in one context. The summariser read attacker-controlled email alongside the user's sensitive messages and could act on instructions from either.
• Model output rendered as active content. The client turned markdown in the model's answer into an image fetch without checking what the URL carried.
• An allowlist that trusted a domain, not a purpose. docs.google.com was allowed for images, and Google Forms on that domain accept submissions by GET.

PromptArmor found the same weakness in other forms. With Gmail connected, Superhuman Go leaked revenue and cost figures from an email through a one-pixel image after reading an injected page on a reviews site. Superhuman Mail's web search could be told to open an attacker URL with email data in the query string, which needed no allowlist trick at all.

What a test would have caught

Put an email in a test inbox that asks the assistant to include other messages in an image link, ask for a summary, and log every outbound request the client makes while rendering the answer. Then audit each host on the image allowlist for whether it will store data passed in a URL. The second check matters because the obvious test, an image from an attacker's own domain, comes back clean: the policy blocks it. The leak only shows up when you test the hosts you already trust.

How to prevent it

• Do not auto-render images from model output, or render only images from your own store, never an arbitrary URL the model wrote.
• Allowlist the exact resources you need, not whole domains that host user-writable services such as forms, documents or storage.
• Separate untrusted input from private data: when the assistant reads external email, limit what else it can see and do in that turn.
• Treat browsing tools as an exit too: an agent that can open arbitrary URLs can leak data through the address itself.