Tag
#security
5 posts tagged “security”.
- 9 min read
The Unfair Advantage of Using Agents for Email
AI agents can send email. Most can't receive it. Here's what happens when you give an agent its own inbox — the Lethal Trifecta of security risks (untrusted content × sensitive data × external communication), how scoped access and reply tokens solve it, and how MailKite, which we build, wires it together.
- 19 min read
Build software that heals itself in the agentic era
An AI agent can write the fix now; the hard part is architecting your software so letting one patch production isn't reckless. Here's a design pattern for self-healing systems: never crash, turn every failure into a structured anonymous signature, and let an agent close the loop behind a sandbox and adversarial gates. Our open-source MIME parser is the worked example; the pattern applies far beyond it.
- 17 min read
You can't prompt your way out of prompt injection
You can't out-write prompt injection with a better system prompt. The fix is architectural: assume the inbox agent is already hijacked and bound what a fooled agent can do. How MailKite's inbox agent is ACL-gated by design, RLS versus a single app-layer choke point, and the limit ACLs can't cover: you can't authenticate who sent an email.
- 7 min read
Why aren't we seeing more agent security discussions?
Agents are writing our codebases and running on our platforms, and the security conversation hasn't caught up. A field note on the vectors that came back, and one I opened on myself.
- 14 min read
How to verify inbound email webhooks (HMAC signatures)
An unverified webhook endpoint is an open door: anyone can POST a fake email.received event. How to verify the HMAC signature with one SDK call in Node, Python, and Go, why the raw body bytes matter, and the hand-rolled check if you can't take a dependency.