How to give your AI agent an email inbox without it emailing the wrong people: 8 practices

Spacesh1psoda · reddit · 2026-11-04

A team building email infrastructure for AI agents shared a full playbook, motivated by two near-misses: an unread 30th approval sent a release email with a dead link to an entire list, and a support agent nearly apologized to 400 customers over a misread template variable. The attack analogue is the Supabase MCP leak, where a support ticket tricked a Cursor agent into exfiltrating tokens — and email widens that door to anyone on the internet.

Eight practices that work with any mail provider:

Don't give it your inbox: one address per agent/role so a prompt injection only sees its own mail
Send from a subdomain (agents.yourcompany.com) to protect your main domain's reputation from spam complaints
Set up SPF, DKIM, DMARC before first send — required by Gmail/Yahoo since 2024 and Outlook since 2025; start DMARC at p=none, read reports, then tighten
Thread replies with Message-ID/In-Reply-To/References headers, not subject lines
Verify who a reply is really from: check DKIM passed and matches the From domain before routing into a customer thread
Treat every inbound email as untrusted input: scan before the agent reads, hold suspicious mail for humans, split read/send jobs
Approve only the first email to a new contact: replies in existing threads go out automatically; most damage comes from new recipients
Put hard limits in code, not prompts: an unremovable suppression list, cooldowns, and dedupe keys on every send

Original post →

How to give your AI agent an email inbox without it emailing the wrong people: 8 practices

More from coding & agent