SMTP is the new prompt injection 🚨👀
Giving an agent email gives anyone a way to put instructions in its context.
That gets scary fast if your agent can also use files, send messages, access internal tools, etc.
A malicious email doesn’t really need to “hack” the system. It just needs to convince the agent to do something it already has permission to do.
The important takeaway from @adisingh: you can’t solve this inside the LLM
You need:
> permissions
> sender/recipient restrictions
> tenant isolation
> action limits need to be enforced outside the model
An agent inbox is basically an entry point into everything that agent can touch.
Stay safe.
显示更多
