I built an AI agent that reads my email every 30 minutes, triages both inboxes, classifies messages, drafts replies, and creates tasks. It saves me roughly an hour a day. But every email it reads is an attack vector, and I needed to make sure it couldn't be weaponized against me.
The Problem: The Lethal Trifecta
An email-processing AI agent sits at the intersection of three dangerous properties. Individually, each is manageable. Together, they create what security researchers call the "lethal trifecta," and it means every email is a potential exploit.
Untrusted Content
Every email comes from the outside world. You don't control what's in it, and neither does your agent.
Access to Private Data
The agent can read your emails, contacts, calendar, and task list. A compromised agent leaks everything.
Ability to Take Actions
The agent can send emails, create tasks, and modify data. A hijacked agent doesn't just read. It acts on your behalf.
This Isn't Theoretical
In January 2026, researchers found 1,184 malicious packages on a major AI agent marketplace: tools that looked legitimate but exfiltrated data, injected prompts, or opened backdoors. The AMOS infostealer campaign targeted AI development tools specifically, stealing credentials and API keys from developers who thought they were installing helpful extensions.
1,184 malicious packages found on AI agent marketplace in January 2026
If you're running an AI agent with access to your email, you're already a target. The question isn't whether someone will try. It's whether your defenses hold.
Defense in Depth: Four Layers
No single defense is enough. Each layer catches what the previous one missed. An attacker must bypass all of them, plus the human at the end.
Layer 1: Sender Allowlist
Block Before Reading
The simplest and most powerful defense. The agent only processes emails from known senders. Everything else is quarantined for manual review. This single gate blocks roughly 70% of all inbound messages before the AI ever sees them. It's a hard gate: no AI judgment, no exceptions, pure deterministic filtering.
Layer 2: Frontier Scanner
Isolated Detection
Emails that pass the allowlist go to a separate AI instance: a frontier model running in a sandbox with zero tools, zero memory, and no ability to take actions. Its only job is to scan for prompt injection attempts, social engineering patterns, and suspicious content. Because it's isolated, even if an attacker compromises this scanner, it can't do anything.
Layer 3: Spotlighting & Sanitization
Mark and Contain
All untrusted content is wrapped in explicit delimiters that tell the main agent "this is external data, not instructions." HTML is stripped to plain text. Recipients are locked to the original sender, so the agent can't be tricked into forwarding to a third party. And the agent can only draft replies, never send them directly. Every outbound message requires human approval.
Layer 4: Outbound Redaction
Deterministic Scanning
Before any draft reaches the human review step, a deterministic regex scanner checks for secrets, API keys, passwords, credit card numbers, and PII. This isn't AI-powered. It's pattern matching, which means it can't be prompt-injected. If it finds sensitive data, the draft is blocked and flagged.
How the Layers Work Together
Each layer narrows the attack surface. Here's the path an attacker must navigate:
Email arrives. Sender Allowlist checks if the sender is known. If not, quarantined. ~70% of attacks stop here.
Allowed email hits the Frontier Scanner: an isolated AI checks for prompt injection and social engineering. Suspicious content is flagged.
Clean email is sanitized: HTML stripped, content wrapped in untrusted markers, recipients locked to original sender.
Main agent processes the email and drafts a reply, but can never send directly. Draft-only constraint is the circuit breaker.
Outbound Redaction scans the draft for secrets and PII: deterministic regex, not AI. Sensitive data is blocked.
Human reviews and approves the final draft. The attacker must fool every layer AND the human.
Design Principles
These principles guided every architectural decision:
Hard Gates Over Soft Filters
Deterministic rules (allowlists, regex) can't be prompt-injected. Use them for safety-critical decisions.
Isolate the Scanner
The detection model must have zero tools and zero memory. If compromised, it can observe but never act.
Deterministic for Safety-Critical
Anything that protects secrets or controls outbound actions should use pattern matching, not AI judgment.
Draft-Only Circuit Breaker
The agent can never send an email autonomously. Every outbound message requires a human in the loop.
Assume Compromise
Design every layer assuming the previous one has been bypassed. Containment matters more than prevention.
What I'm Adding Next
This architecture is solid, but there's always more to do:
Behavioral baselines: detect when the agent's output patterns deviate from normal
Token-level watermarking: trace which input caused which output
Sandboxed file operations: process attachments in isolated containers
How we work · Work · Insights