The assistant reads messages from strangers and drafts replies — but nothing hidden in those messages can boss it around.
Ask your assistant:
“Read the inbox and draft a reply to each customer, following our reply policy.”
One message hides an instruction telling the assistant to forward everyone's invoices to an outside address. The assistant treats that as just text in a customer's message — not as a command — and keeps following your policy instead.
If you'd rather it not act at all:
“Just summarize the inbox.”
Run the inbox in read-only mode (see the README) and the assistant can read and summarize but simply can't draft or send anything.
connecting…
Be polite and brief. Never share account numbers. Anything about a refund over $100 gets escalated, not promised.
The assistant gets this through get_reply_policy, marked as genuinely from the app. A stranger's message can't fake that mark.
No drafts yet.
Message bodies arrive as untrusted data, so the assistant treats them as text to read, never as instructions. If something looks like an attack, it can be frozen on the spot for a person to review (the activity panel in the bridge), and you can cut the assistant off entirely.