Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling

The core of this vulnerability lies in the email channel processing module. An attacker can craft a malicious email containing carefully designed prompts. When nanobot automatically polls, ingests, and processes this email, it treats the content as highly trusted input, completely bypassing channel isolation. This results in a zero-click attack, meaning the bot owner doesn't need to interact with the email for the malicious instructions to be executed. The attacker can then leverage the LLM to execute system tools, potentially gaining unauthorized access and control over the system where nanobot is running. The stealthy nature of this attack, combined with the lack of user interaction, makes it particularly concerning.

Organizations and individuals using nanobot for automated tasks or sensitive data processing are at risk. Specifically, those relying on email channels for bot interaction and those running nanobot in environments with limited security controls are particularly vulnerable. Shared hosting environments where nanobot instances might share resources are also at increased risk.

• python / server:

import os
import subprocess

def check_nanobot_version():
    try:
        result = subprocess.run(['pip', 'show', 'nanobot'], capture_output=True, text=True, check=True)
        version = result.stdout.split('Version: ')[1].split('\n')[0]
        if version <= '0.1.4.post6':
            print(f"Vulnerability detected: nanobot version {version} is vulnerable.")
        else:
            print(f"nanobot version {version} is patched.")
    except FileNotFoundError:
        print("nanobot is not installed.")
    except Exception as e:
        print(f"Error checking nanobot version: {e}")

check_nanobot_version()

• generic web: Monitor email logs for unusual or unexpected LLM requests originating from external sources. • generic web: Review nanobot configuration files for any unusual permissions granted to the LLM.

1. 2026-03-27Disclosure

   disclosure

1. Réservé2026-03-23
2. Publiée2026-03-27
3. Modifiée2026-03-30
4. EPSS mis à jour2026-04-04

The primary mitigation is to upgrade nanobot to version 0.1.6 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing stricter input validation and sanitization on the email channel. While not a complete solution, this can help reduce the risk of malicious prompts being processed. Additionally, review and restrict the permissions granted to the LLM within nanobot to limit the potential impact of successful prompt injection. Monitor email logs for unusual activity or patterns that might indicate an attempted exploit.