Anyone can email your agent (MachineMail)
Your organisation's newest attack surface may already have an email address that reads everything it receives and is trained to be helpful.
This week MachineMail launched, giving AI agents real inboxes that can sign up for services, receive codes and reply to anyone. The telling detail is defensive: each inbound message is treated as untrusted input and scored for hostile intent before the agent reads it. That is not a feature so much as an admission of what an agent inbox is.
The human version of this surface just cost Binance US$6.3 billion, the largest crypto theft on record: attackers the FBI attributes to North Korea posed as recruiters, ran a software engineer through months of interviews for a fictitious company and got them to install a malicious coding assignment on their work machine. That was months of social engineering against a cautious human.
The agent version of the same attack scales differently. What took months with a person can be attempted repeatedly and automatically: an agent can be approached at scale and acts on instructions written in plain language, and harm follows when untrusted content can trigger an authorised action without an effective control in between. The fake job offer becomes the fake customer email, the fake invoice, the fake colleague's request. That is a possibility to design against, not a verdict on any product.
Two disciplines have to meet. MachineMail's inbound trust scoring is email security rebuilt for software that reads on your behalf. AgentKit, another launch this week, runs each tool call as the person who granted access rather than a shared service account, so authority stays with a human.
Two questions belong in every deployment review before an agent goes near production. What can reach it? And whose authority does it act with when it responds?
Security programmes have spent years teaching people not to click. The discipline that does the same for agents belongs in the deployment budget, not the incident report.
#Cybersecurity #AI #Agents #Crypto #Securities #Fraud
Sources:
- MachineMail launch (Product Hunt): https://lnkd.in/gfXWFsSX
- Scalekit, AgentKit: https://lnkd.in/gXGih-nZ
- The Guardian, the fake-recruiter operation: https://lnkd.in/g-H8K7g8
- FBI attribution of the Binance attack: https://lnkd.in/gGcHadBb