Building a personal agent with email access led to one security rule: block the dangerous trio

SIGH_I_CALL · reddit · 2026-09-08

A developer built a personal agent that reads his inbox, files, and screen and takes actions, concluding that security work matters less about making the model smart enough to spot prompt injection and more about assuming it eventually won't.

His rule: private data + untrusted content + an outbound channel = hard stop. A malicious page or poisoned email alone isn't catastrophic; the dangerous state is when an agent can read untrusted instructions, access private data, and send information externally in the same path. Instead of detecting every injection, he restricts which capabilities may coexist — some transitions require approval or are structurally impossible. He argues agent security's core question is shifting from "can the model recognize the attack?" to "what can the system do when the model inevitably gets fooled?" and published his architecture and threat model.

Original post →

Building a personal agent with email access led to one security rule: block the dangerous trio

More from coding & agent