An email assistant is the riskiest place to put a model. The reason is one sentence long: email is the one channel where a stranger on the internet can put text in front of your agent, and some of it is written to manipulate it. A phishing lure is aimed at the person who opens the mail. Prompt injection is aimed at the model that reads the same mail. As of this week the two are being combined in the wild, which means the inbox is no longer a place where the model just gets an embarrassing answer. It is a place where the model can be talked into an action.

A dev.to project from this week took that threat seriously and built the opposite of what most people would reach for. It did not bolt on a bigger model or a cleverer guardrail prompt. It built an assistant whose most important property is a negative one: it reads everything, and it can send nothing. I read the write-up in full.…