An agent reading your inbox is reading attacker-controlled text
SpiderMail scans every message before an agent sees it, and checks every message before it sends. Both layers are on by default — there is no setting to enable.
Two layers, both always on
Inbound scanning
Every stored message is checked before an agent reads it, across four families of technique: instruction override, persona reassignment, requests for secrets or history, and fake system blocks.
Obfuscation decoding
Encoded blocks, escape sequences and zero-width characters are decoded and re-scanned, because hiding the sentence is the obvious next move.
Outbound credential blocking
Provider keys, payment keys, cloud access keys, private keys and auth headers are caught before SMTP. A match blocks the send and returns the reason to the caller.
A reviewable quarantine
A held message waits out of the inbox until a person reads it. Nothing is deleted, and releasing one records that you did it.
A full event log
Every detection is recorded and readable over the API, the CLI and MCP — filterable by mailbox and event type.
Agent-native
The same three endpoints your agents already reach through the mail skill. No separate console, no extra credential.
We publish what it gets wrong, too
A security page that only lists wins is not a security page. As of 10 August 2026 the inbound patterns are broader than they should be: of 108 messages held across our own accounts, roughly 94% were ordinary mail — newsletters saying “don't forget your meeting” or “we can send emails” — caught by two rules whose qualifying words are optional.
That is why the quarantine is reviewable and releasable rather than silent, and it is why we would rather you read the numbers than take a badge on trust. The full count, the cause and the fix are in the write-up, and the current state is recorded under Known issues in the changelog.
Treat both scanners as a backstop. Pattern lists are designed to catch known technique and are updated as technique changes — your agent's own instructions remain the first line of defence.
See what your own mailbox is catching
Three endpoints, an ordinary client token, no special access. Or open the Security page in the dashboard.
Security API reference