Don't dismiss the root cause because the usecase is silly. The moment some user provided input reaches an LLM context, all bets are off. If you're running any local tools that provide shell access, then it's RCE, if you're running a browser / fetch tool that's data exfil, and so on.

The root cause is that LLMs receive both commands and data on the same shared channel. Until (if) this gets fixed, we're gonna see lots and lots of similar attacks.

MCP enabled software gives you a list of options. If you check the Gmail one and the shell one you are instantly vulnerable to this kind of attack.

Common? Also, yes.

This one targets Claude. But we've already seen it with Copilot and I expect we'll soon see it hit Gemini, and others.

AI is being forcibly integrated across all major systems. Your email provider will set this up, if they haven't already.