Zero-Trust Email: Why Perimeter Security Fails for AI Agents
Maya Lindström
2 min read
The Trust Problem
Traditional email security operates on a binary model: a message is either "safe" or "spam." Once it passes through your gateway's SPF, DKIM, and DMARC checks, it's treated as trusted content.
But when an AI agent processes that email, the trust model breaks down entirely.
Why Perimeter Security Fails
Consider what happens when an LLM reads an email that passed all authentication checks:
Hidden instructions embedded in HTML comments bypass visual inspection
Invisible text (white-on-white, zero-font-size) is perfectly readable to AI
Base64-encoded payloads can contain prompt injections
Legitimate sender accounts can be compromised
The Zero-Trust Approach
SpiderMail implements zero-trust at the content level:
Strip all formatting — convert to clean, typed YAML
Sanitize every field — remove hidden content, scripts, tracking
Classify intent — tag each message with semantic metadata
Enforce boundaries — prevent agent actions on untrusted content
"Don't trust the envelope. Don't trust the sender. Don't even trust the words — verify the intent." — SpiderMail Security Manifesto
Implementation
Our pipeline processes every email through 7 sanitization layers before any AI agent sees it. Each layer operates independently, ensuring defense in depth.
The result: agents can safely process email without risking prompt injection, data exfiltration, or unauthorized actions.