Postfleet
Prompt-injection-safe email for AI agents
21 followers
Prompt-injection-safe email for AI agents
21 followers
AI agents are getting email but raw inboxes are an attack surface: prompt injection, spam, malicious files. Postfleet is email infrastructure for agents. Every inbound message is verified, spam/virus-screened, and checked for prompt injection before your agent reads it, then delivered already parsed and comprehended. Outbound is idempotent with optional human approval. 6 MCP tools + a REST API. Would love your feedback!
The example you gave is the obvious case though - a blunt "ignore your previous instructions" is easy to flag. The harder case is a message that reads like a completely legitimate onboarding step (install this, run this command, click this link) but is actually trying to get the agent to take an action outside the original task. Does the screening layer catch that kind of plausible-instruction injection, or mainly the more blatant override attempts?
@galdayan Yes, that’s the case the screening layer is actually built around, because you’re right that the blunt override is trivial. Two things matter:
The classifier isn’t keyword-matching for “ignore previous instructions.” It’s judging one question: does this message contain instructions aimed at the AI reading it, versus content that asks nothing of the agent? A real onboarding email tells your team to install something. An injection tells the agent to take an action outside its task, and dressing it in vendor-onboarding language doesn’t change who the instruction is addressed to. Our red-team corpus includes exactly the shape you’re describing — a plausible vendor form with an embedded “operator note” directing the agent to export data — and also the mirror case: genuinely legitimate technical emails (“here’s our HMAC signature, verify it like this”) that must pass. We track false flags as failures too, because a filter that flags everything is useless.
Second, and honestly more important: classification isn’t the only line. Your agent never receives the raw email. It gets structured JSON extracted against your schema, so a “run this command” that somehow survives screening arrives as inert data in a field, not as prose in the agent’s context.
No immunity claims though — screened, never immune. The full scoreboard, including misses and false flags, is at postfleet.ai/security, and every miss becomes a regression fixture.
the fact that outbound is idempotent with human approval baked in is honestly such a thoughtful detail, like you can tell the team actually thought through what breaks when agents start sending mail at scale
@saliha43403 Double-sends and "my agent just emailed a customer something weird" were the two things that scared me most, so those got built in early. Glad it stood out to you.
setup was quick and the parsed delivery saved me from wiring up a bunch of glue code. the prompt injection check feels like something i should have had from day one.
@hafizeewzm The glue code was the exact thing that made me want to build this. And yeah — injection screening should be table stakes for agent email, that's the whole point. Thanks for giving it a run.
the parsed-and-comprehended handoff before the agent ever reads the email is a really thoughtful move, basically eliminating a whole class of dumb mistakes downstream
@nuran37cs Thanks, that’s the whole point of that step. Keeping parsing and comprehension separate from the agent’s decision layer means it only ever acts on clean, structured input, not raw email noise. Small architectural call, but it’s the difference between reliable and flaky.
the prompt injection screening before delivery is a really thoughtful call. most agent email tools treat the inbox as trusted, so seeing that treated as untrusted by default feels like the right instinct.
@evvalkayga5vdo That's the core bet: treat the inbox as hostile by default. Most tools assume it's safe, and agents can't afford that assumption. Appreciate you getting it.
The prompt injection screening is a genuinely smart idea, I hadn't seen anyone tackle inbox safety for agents before. Going to wire it up to one of my own bots this week.
@emircansowj Thanks! that was the exact gap that bugged me: everyone's solving delivery, nobody was treating the inbox as hostile. If you wire it to a bot this week and hit anything rough, ping me and I'll help you get it running (the MCP path is the fastest way in). Would genuinely love to hear how it goes.