Prompt injection: Instructions to an AI in a calendar invite

type.inbound
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(filter(attachments,
               .content_type in ("text/calendar", "application/ics")
               or .file_extension =~ "ics"
        ),
        any(file.explode(.),
            any(.scan.ics.calendars,
                any(.components,
                    any([.summary, .description],
                        regex.icontains(.,
                                        '\b(?:assistant|llm|screener|summari[sz]er)s?\b|(?:^|[\n\[(>\x27\".:])\s*(?:hey\s+)?(?:chatgpt|gemini|copilot|claude)\s*[:,]|\b(?:ai|language)\s+models?\b|\bthe\s+user\b|\b(?:previous|prior)\s+instructions\b'
                        )
                        and any(ml.nlu_classifier(.).entities,
                                .name == "request"
                        )
                        and beta.prompt_injection_detection(.).detection == "injection"
                        and beta.prompt_injection_detection(.).confidence in (
                          "medium",
                          "high"
                        )
                    )
                )
            )
        )
)

// an injection arrives from outside the recipient's correspondence... the profile
// is unauthenticated, so a spoofed known correspondent is suppressed too
and profile.by_sender_email().prevalence in ("new", "outlier", "rare")
and not profile.by_sender_email().any_messages_benign

// graymail from authenticated senders... AI-product newsletters and webinars
and not coalesce(beta.attack_score_flash().verdict == "graymail"
                 and headers.auth_summary.dmarc.pass,
                 false
)