Email is probably the most exposed ingestion vector in practice because the barrier to entry is zero -- anyone can send an email to a monitored inbox. The "looks completely normal to a human" property is exactly what the semantic injection variant exploits. No structural markers, no suspicious formatting, just authoritative-sounding natural language.

What did your detection layer end up looking like? Rule-based or ML-based?