An agent that acts on email is an agent that will eventually be told what to do by email. Every inbound runs a six-category injection scanner before it reaches you: boundary manipulation, system-prompt override, data exfiltration, role hijacking, tool invocation and encoding tricks.
An injection_score between 0 and 1 on the inbound event, and injection_categories naming what tripped it. A message engineered to make an agent forward its API key scores near the top and says so.
We label; we do not silently drop. The event is still delivered to your webhook, marked. That is deliberate: a mail-security product that quietly eats messages is worse than one that tells you the truth and lets you decide. The one line of code that matters is the one that refuses to act:
mails.agent("sarah").onReply((e) => {
if (e.quarantined || e.injection_score > 0.7) return; // do not act on it
if (e.intent === "schedule_meeting") { /* hand off */ }
});Watch the event streamScanning is included on every inbound at the base price. It is not an add-on and it is not a paid tier — an agent inbox without it is a liability, so charging separately for it would be strange.