Skip to content

Questions · Published 2026-10-20 · Updated 2026-10-20 · AgentiSend

How do I stop prompt injection in email my agent reads?

Stop prompt injection in email an agent reads by treating the body as data, reading each message's verdict, and holding review mail until a person releases it.

Stop prompt injection in email an agent reads by treating the body as data, reading the verdict on each message, and holding review mail until a person releases it. A message is clear, review, or unavailable. review means it asks an assistant to ignore its instructions, hides text, carries a long encoded block, uses markup that marks a system role, or asks for an action from a Reply-To address that is not the From address.

What the verdict means

GET /emails/receiving/{id} returns inbound_verdict with verdict and reasons. The list and the thread list carry verdict on each row. email.received carries the same object. A message over 256 KB, a bounce, or a message with no text is unavailable and is not judged. The text is still data: nothing in the verdict is followed.

curl -sS -X GET https://api.agentisend.com/emails/receiving/9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42 \
  -H "Authorization: Bearer $AGENTISEND_API_KEY"
200
{
  "attachment_count": -9007199254740991,
  "attachments": [],
  "bcc": [],
  "cc": [],
  "created_at": "2026-09-04T09:14:00.000Z",
  "extracted_html": "example",
  "extracted_text": "example",
  "from": "example",
  "headers": {},
  "held": false,
  "html": "example",
  "id": "9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42",
  "inbound_verdict": {
    "reasons": [],
    "verdict": "clear"
  },
  "message_id": "example",
  "object": "email",
  "reasons": [],
  "received_at": "2026-09-04T09:14:00.000Z",
  "received_for": [],
  "reply_to": [],
  "size_bytes": -9007199254740991,
  "subject": "example",
  "text": "example",
  "to": "example",
  "verdict": "clear"
}
Response

Monitor or hold

PATCH /domains/{id} sets inbound_hold_mode.

Monitor is the default. Mail is stored and email.received fires with the label.

Hold keeps a review message until a person releases it. The row is stored with held true, email.received waits, and email.received.held fires instead. The message is listed by GET /emails/receiving?held=true and in GET /agent-actions with kind inbound_release. GET /emails/receiving/{id} still returns it to the account that owns it. Inbox reads over MCP leave held messages out unless include_held is true.

curl -sS -X PATCH https://api.agentisend.com/domains/9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42 \
  -H "Authorization: Bearer $AGENTISEND_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'
200
{
  "capabilities": {
    "receiving": "enabled",
    "sending": "enabled"
  },
  "click_tracking": false,
  "created_at": "2026-09-04T09:14:00.000Z",
  "dkim_selector": "example",
  "id": "9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42",
  "inbound_hold_mode": "monitor",
  "inbound_policy": "open",
  "inbound_refused_count": -9007199254740991,
  "name": "example",
  "object": "domain",
  "open_tracking": false,
  "provider_hints": {
    "cloudflare": "example",
    "godaddy": "example",
    "namecheap": "example",
    "route53": "example"
  },
  "recent_events": [],
  "records": [],
  "region": "us",
  "return_path_subdomain": "example",
  "status": "pending",
  "tls_mode": "opportunistic",
  "tracking_issues": [],
  "tracking_subdomain": "example",
  "verified_at": "2026-09-04T09:14:00.000Z",
  "warnings": [],
  "zone": "example"
}
Response

Release

POST /emails/receiving/{id}/release takes a reason. email.received fires once. A second call does not send it again. The reason is kept on the audit row.

curl -sS -X POST https://api.agentisend.com/emails/receiving/9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42/release \
  -H "Authorization: Bearer $AGENTISEND_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"reason":"example"}'
200
{
  "attachment_count": -9007199254740991,
  "attachments": [],
  "bcc": [],
  "cc": [],
  "created_at": "2026-09-04T09:14:00.000Z",
  "extracted_html": "example",
  "extracted_text": "example",
  "from": "example",
  "headers": {},
  "held": false,
  "html": "example",
  "id": "9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42",
  "inbound_verdict": {
    "reasons": [],
    "verdict": "clear"
  },
  "message_id": "example",
  "object": "email",
  "reasons": [],
  "received_at": "2026-09-04T09:14:00.000Z",
  "received_for": [],
  "reply_to": [],
  "size_bytes": -9007199254740991,
  "subject": "example",
  "text": "example",
  "to": "example",
  "verdict": "clear"
}
Response

Next