Larsen Cundric(@larsencc):SMTP is the new prompt injection 🚨👀 Giving an agent email gives anyone a way to put instructions in its context. That gets scary fast if your agent can also use files, send messages, access internal tools, etc. A malicious email doesn’t really need to “hack” the system. It just needs to convince the agent to do something it already has permission to do. The important takeaway from @adisingh: you can’t solve this inside the LLM You need: > permissions > sender/recipient restrictions > tenant isolation > action limits need to be enforced outside the model An agent inbox is basically an entry point into everything that agent can touch. Stay safe.

2026.09.10 22:51

SMTP is the new prompt injection 🚨👀 Giving an agent email gives anyone a way to put instructions in its context. That gets scary fast if your agent can also use files, send messages, access internal tools, etc. A malicious email doesn’t really need to “hack” the system. It just needs to convince the agent to do something it already has permission to do. The important takeaway from @adisingh: you can’t solve this inside the LLM You need: > permissions > sender/recipient restrictions > tenant isolation > action limits need to be enforced outside the model An agent inbox is basically an entry point into everything that agent can touch. Stay safe.