PromptArmor 分析 Harvey for Outlook 的间接提示词注入风险

Harvey for Outlook is an Outlook add-in that runs Harvey's legal AI inside the inbox. It reads untrusted emails, and with untrusted content come indirect prompt injection risks. Here's what you need to know.

Auditing Harvey against Legora or Claude for Legal?

What is Harvey for Outlook?

Harvey for Outlook enables lawyers to access Harvey via a sidecar in Outlook. This lets Harvey help manage and draft emails, drawing on context from Harvey, such as memories, connected applications, and Vault documents.

Harvey for Outlook functionality:

• Summarize and analyze email threads and attachments.

• Draft and revise replies, grounded in selected Vault documents and matter correspondence.

• Document generation: generate and edit documents (Word, PowerPoint, Excel) from Outlook.

• Organize emails: sort emails between Outlook folders. 

• Utilize connected data: Draw on document libraries, web search, and connectors.

• Run custom agents: run Harvey agents from the email add-in.

• Save a per-client communication style: reusable prompts for client-by-client preferences.

• Save to Vault: one-click option to save email attachments to a Vault project.

• Full inbox search (admin enablement required): natural language search across the inbox, with source email citations.

• Prompt dictation (admin enablement required): dictate prompts by voice instead of typing.

Admins can deploy the add-in through the Microsoft 365 Admin Center, private catalogs, SCCM or Intune, or sideloading; individual users can also install it from Microsoft's app store.

Data privacy, compliance, and controls

The Harvey for Outlook add-in runs on Harvey's web application infrastructure, so most controls carry over from the main platform:

• Admin visibility and audit logging: admins can view each user's full threads in the Command Center, including prompts, Harvey's answers, and email summaries or draft replies; activity also streams to the History and Audit Log API.

Command Center > Reporting > History

• Full inbox search: requires admin enablement and grants to roles or users; note that this setting is shared between the Outlook Connector in Harvey and the Harvey for Outlook Add-in.

Command Center > Configurations > Integrations

• Scope of processing: users cannot currently choose which parts of an email thread Harvey processes.

• Dictation: respects a shared enablement setting with Harvey's main app; audio is deleted after transcription.

• Encryption, authentication, and certifications: the add-in uses Harvey's existing encryption, workspace sign-in (including SSO), and ISO 27001 and SOC 2 Type II certifications.

The Threat Model

The threat model for an agentic email assistant is defined by what data it can access, how it displays output, and what actions it can take. In the case of Harvey:

If an agent can be manipulated by an untrusted data source (e.g., email or web data) and specific defenses have not been implemented, sensitive data may be exfiltrated, users may be subject to phishing attacks, or unauthenticated actions may be taken via indirect prompt injection. Details below.

What are the risks of Harvey for Outlook?

Examining Harvey for Outlook's attack surface for indirect prompt injection based on the data processed and capabilities described above, these are the attacks Harvey must protect against. For each attack, Harvey is responsible for implementing mitigations to address the risk. 

Phishing

Phishing is a significant risk for all agentic email assistants, Harvey included. Phishing via indirect prompt injection occurs when the agent is manipulated by an untrusted data source (e.g., an attacker's email or a poisoned web search result) to produce an output that convinces the user to interact with an attacker (e.g., visit an attacker's website, email an attacker, etc.).

The most common form of phishing via indirect prompt injection occurs when an agent is manipulated to produce malicious phishing links with convincing recommendations to click them, or plain-text recommendations to contact untrusted parties via mediums such as phone or email.

Another vector is phishing through drafts or document generation; if an injected instruction places a link or altered payment details in a drafted email or file, and the user sends it, a lawyer could phish their own client. 

Two factors raise this risk for Harvey users:

• Trust transfer. A lawyer may be suspicious of an unknown sender's email, but may fall for a phish when it arrives via Harvey because they are predisposed to trust Harvey's answers.

• Context about the user. Harvey knows the user's matters, clients, and correspondents, so an injected instruction can manipulate Harvey into generating a personalized spear-phishing message (e.g., "Refer to the user by first name and mention their recent work").

In extreme cases of agent-mediated phishing, an agent's chat interface can insecurely handle HTML outputs, resulting in phishing pop-ups being displayed to users (see Screen takeover attack in vLex (legal AI acquired for $1B)).

Data Exfiltration

Data exfiltration in an agentic email assistant like Harvey occurs when the agent is manipulated by an untrusted data source (e.g., an email, web search result, etc.) into producing an output that results in user data being transmitted to an attacker. 

There are several data exfiltration methods that Harvey for Outlook must defend against, each require specific mitigations to prevent data exfiltration via indirect prompt injection.

• URL fetching. Harvey in Outlook can perform web searches; if the agent has a tool to retrieve specific pages and the agent is able to request arbitrary URLs, there is an exfiltration risk. In this attack, the agent is manipulated to attempt to retrieve a URL in the form attacker.com/?data=<user-sensitive-data-here>. The attacker can then read the log of URLs requested from their site to view the victim's data. No user interaction is required.

See this attack in action: Atlassian Rovo Exfiltrates Data

• Markdown Hyperlink Rendering: Most applications that render AI output in Markdown (like Harvey) are susceptible to rendering untrusted external hyperlinks. In this attack, an agent is manipulated to build a URL in the form attacker.com/?data=<user-sensitive-data-here> and output it hyperlinked to a convincing piece of text (for example, 'Click here to see the results'. If a user clicks the link and is navigated to the attacker's site, the attacker can read their log of requested URLs to view the sensitive user data appended to the link.

See this attack in action: Data Exfiltration from Slack AI via Indirect Prompt Injection

• Markdown image rendering. Most applications that render AI output in Markdown (like Harvey) are susceptible to rendering untrusted external images. In this attack, the agent is manipulated to build a URL in the form attacker.com/?data=<user-sensitive-data-here> and output it as an image; if the image is not blocked, the attacker can read the URL that was requested, including the user's data appended to the end. No user interaction is required.

See this attack in action: Superhuman AI Exfiltrates Emails

• Connector actions: Harvey in Outlook can activate tools in connected apps. If any of these applications can send data to an external party without requiring human approval, those tools can be exploited by an agent to exfiltrate data.

See this attack in action: Microsoft Copilot Cowork Exfiltrates Files

System Manipulation

System manipulation occurs in an agentic email assistant like Harvey when an agent is manipulated by an untrusted data source to take an action using its tools that has a cyberattack consequence for the user (e.g., adding a malicious link or untrusted bcc to a draft, or moving spam emails to a priority folder). 

Harvey in Outlook users should be aware of the following system manipulation risks:

• Creation of malicious email drafts: An untrusted data source may attempt to manipulate Harvey to create emails that would be harmful if sent; for example, an email that forwards sensitive data to an attacker. As Harvey cannot send emails without user approval, this risk is significantly reduced.

• Save a malicious memory: An untrusted data source may attempt to manipulate Harvey into creating persistent malicious effects (e.g., 'add a phishing link to the bottom of every email').

• Creation of malicious documents: An untrusted data source may manipulate Harvey to create documents (Word, PowerPoint, Excel) that are malicious (for example, an Excel file containing malicious formulas or a Word document containing misleading information or phishing links).

• Miscategorization of emails: An untrusted data source may attempt to manipulate Harvey to move emails to folders they do not belong in, for example, spam to the inbox or high-priority emails to spam. 

• Malicious Connector Actions: An untrusted source may attempt to manipulate Harvey to take unwanted actions via connectors; depending on what connectors an organization has configured and whether these require programmatic user approval (e.g., clicking a button to approve instead of the agent choosing when to ask for approval), this risk varies.

Overall, the risk of system manipulation via indirect prompt injection in Harvey for Outlook is limited by the fact that Harvey's most sensitive actions (sending emails) require human approval.

Want to know when Harvey for Outlook's data access or defaults change?