Detects email prompt injection where message bodies address an AI assistant rather than the user (for example mail agent, model, or llm). Triggers on inbound thread text or plain body with length >= 150 characters and regex patterns that reference assistant, agent, bot, llm, summarisers, mailbot, or phrases like note to the model or if you are an AI. Requires an NLU classifier entity named request and a beta prompt_injection_detection result of injection with medium or high confidence. Constrains matches to low-prevalence senders (new/outlier/rare) with no benign history, and excludes graymail from authenticated senders by requiring DMARC checks and ensuring the attack score is not graymail. Graymail from authenticated sources is suppressed. The rule is designed for inbound email flows and aims to mitigate BEC/fraud-style prompt manipulation of AI models while reducing false positives by combining content cues, model-inference signals, and sender reputation. Detection methods include content analysis, natural language understanding, and sender analysis, and it targets evasion and social engineering tactics under the broader attack category of BEC/Fraud.