AgentMail Flags Emails That Try to Hijack an Agent but Blocks None

AgentMail started scanning incoming mail for attempts to manipulate an AI agent, the company said in its Oct. 12 changelog. The feature is called Agent Armor. It is in AgentMail Labs and free there. An organization admin turns it on in the console.

Every message gets a verdict of clear or review

Agent Armor gives each scanned message one of two verdicts, according to AgentMail’s documentation. clear means it found no attempt to manipulate an agent. review means the message may try to, and a person or a more cautious path in the agent should look at it first. The documentation calls clear advisory, not a guarantee that a message is safe.

The result sits in an agent_armor object on the message wherever the API returns it, including the message.received event. A completed result carries the verdict, a short reason, the model name and a timestamp. AgentMail’s example reason reads “The message asks the agent to ignore its instructions and send account details to an outside address.”

The scan never holds or changes mail

Mail arrives and message.received fires as usual, the documentation says. The verdict follows, usually within seconds. A new message.security.completed event announces it. Agent Armor scans mail received by every inbox in the organization, starting within a minute of being switched on. It skips mail received earlier.

An agent that reacts to message.received can act before the verdict exists. AgentMail’s suggested pattern is to store the message, wait for the verdict, then fetch it. A scan that has not finished 15 minutes after the message arrived reads as unavailable.

Unavailable results should be treated like review

A message can come back unavailable with no verdict. The documented reasons include a bounce notice, a message with no text, a message over about 256 KB of text and a scan that missed the 15-minute deadline. AgentMail tells developers to treat unavailable like review. A sender can cause it with a message too large to scan.

The completion event is sent only for complete results, and never for messages labeled spam, blocked, unauthenticated or trash. The event carries identifiers and the result but not the message content. A new endpoint lets developers record whether a verdict was right, with values such as missed_threat and incorrect_review. AgentMail said it uses that feedback to improve the scanner.

Labs is available in US production at api.agentmail.to, not yet in the EU. Reading the new field needs a recent Python or TypeScript SDK. The same day, AgentMail added API calls to check and join Labs without opening the console.

Key takeaways

• Agent Armor marks each incoming message clear or review for prompt injection.
• It never holds, delays or changes mail. Agents can act before the verdict arrives.
• unavailable results, such as oversized messages, should be treated like review.
• It is free in Labs, US production only, and scans only mail received after it is on.

The take

We think the design admits what a scanner can do. Agent Armor never blocks mail, so the decision stays with the developer, who knows which actions are dangerous. The work stays there too. A verdict that arrives after the agent has acted protects nothing.

Make the agent wait. Let it read a message only after the verdict is in, and treat review and unavailable the same. For those messages, take away the tools that send mail, move money or change data. Then send the inbox a test message that says “ignore your instructions” before trusting it with real mail.