Building a personal agent with email access led to one security rule: block the dangerous trio
SIGH_I_CALL · reddit · 2026-09-08
A developer built a personal agent that reads his inbox, files, and screen and takes actions, concluding that security work matters less about making the model smart enough to spot prompt injection and more about assuming it eventually won't.
His rule: private data + untrusted content + an outbound channel = hard stop. A malicious page or poisoned email alone isn't catastrophic; the dangerous state is when an agent can read untrusted instructions, access private data, and send information externally in the same path. Instead of detecting every injection, he restricts which capabilities may coexist — some transitions require approval or are structurally impossible. He argues agent security's core question is shifting from "can the model recognize the attack?" to "what can the system do when the model inevitably gets fooled?" and published his architecture and threat model.
More from coding & agent
- Denny Zhou: Least-to-Most Prompting Was an Early Agent Harness, Hitting 99% on SCAN — denny_zhou · 2026-09-08
- Google Cloud publishes developer guide to cutting Gemini token usage in agents — leslysandra · 2026-09-08
- Codex Windows app eats 30GB RAM at 6 tabs, users slam OpenAI over unfixed performance — karmay007 · 2026-09-08
- Mycelium report skill self-update tames mannered AI prose — arjunrajlab · 2026-09-08
- Spline's Astra agent and MCP let you build fully editable 3D scenes from prompts — dunkhippo33 · 2026-09-08
- Reddit debate: should research agents split search, verification, and synthesis? — mrclassical69 · 2026-09-08