Least privilege, research/action split: lessons from a sales agent that faced prompt injection
Adept_Direction2591 · reddit · 2026-10-21
The author of Lunaar's sales agent shares three design principles: least privilege per bot (triage reads mail but can't send; outreach drafts but never sends without approval), separating research from action (the action bot only sees structured summaries, never raw scraped pages — cutting prompt injection risk), and deterministic scheduling in code. The burn: an early version let page content flow straight into the drafting prompt. Lesson: treat all scraped/inbox content as untrusted input.
More from coding & agent
- Meta open-sources Muse Glimmer 30B, an on-device agentic model rivaling Gemma4-31B — meta · 2026-10-21
- Reverse-engineering Futurama game took a month and $1,266 of Claude Code Opus — JasonBotterill · 2026-10-21
- 10 open-source repos for building AI research agents, from GPT Researcher to Docling — Shruti_0810 · 2026-10-21
- Claude vs Codex for browser automation: Codex acts, Claude balks at trivial steps — Capaj · 2026-10-21
- Anchor SDK: an open-source TypeScript agent harness with sandboxes, memory, and traces — Elegant_Fish_3822 · 2026-10-21
- What actually broke moving agents from demo to production: 5 lessons — No-Age-3362 · 2026-10-21