Indirect Prompt Injection in Email-Reading Agents
You are building an email manager agent that reads incoming emails and executes operations (like booking meetings, replying, or summarizing newsletters).
Explain the security threat of Indirect Prompt Injection in this context. How could an attacker exploit this via an external email, and what defensive architectures must be implemented to protect the user's workspace?