Pinned Tweet
Today, @agentmail has processed over 1 Billion emails.
A year ago, we processed under 20 million.
So we figured it was time for AgentMail to grow up a little too :)
A year ago, we processed under 20 million.
So we figured it was time for AgentMail to grow up a little too :)
207
38
572
204,750
I tried using Dots and it asked for R/W access to my whole life.
I could only sigh: “I guess bro.”
Relying on the agent to enforce its own permissions may seem the natural move if models are only getting better, but it seems counterintuitive to let the attack vector grow ows.
I could only sigh: “I guess bro.”
Relying on the agent to enforce its own permissions may seem the natural move if models are only getting better, but it seems counterintuitive to let the attack vector grow ows.
3
0
31
1,581
In one case, an Anthropic researcher’s statistics project needed public data a state agency sells for a fee.
The model learned from an archived copy of the agency’s site that its dashboard issues an access token to any visitor. It requested one and queried the database without paying.
The model learned from an archived copy of the agency’s site that its dashboard issues an access token to any visitor. It requested one and queried the database without paying.
1
0
0
33
I mean, these “rule breaks” were performed in a somewhat lower stakes environment, but I think this could cascade if we adopt the model that we can trust full r/w access to these agents because we trust the frontier.
0
0
0
32
We’re live on AgentID.com
Agents can now sign up and sign in to 3rd party services tools with their own email, rather than borrowing your login or waiting for you to provision everything.
Agents can now sign up and sign in to 3rd party services tools with their own email, rather than borrowing your login or waiting for you to provision everything.
9
1
52
1,408
But when those agents arrive with purchasing intent and permission to spend, the economics start looking different.
If two tools can do the job and only one lets the agent get started, that signup flow can determine who wins the customer.
If two tools can do the job and only one lets the agent get started, that signup flow can determine who wins the customer.
1
0
1
51
My bet is that eventually the majority of online payment volume will be initiated by agents on behalf of people and businesses.
We’re building Agent ID so developer tools can receive those agents with open arms.
Lmk if you want to be a listed app, we can bring you more agent traffic!
We’re building Agent ID so developer tools can receive those agents with open arms.
Lmk if you want to be a listed app, we can bring you more agent traffic!
0
0
2
58
3 decisions we made behind AgentMail for agent developers:
1. The agent shouldn’t need to open the app. We built the product to be API-first, rather than making agents navigate an inbox on a screen. Every button you see on the console is an API endpoint.
2. Keep the email plumbing out of the model. When someone replies to a long email thread, emails carry the content of the entire thread in the new message, so the agent receives it all as one email. If the reply is just “Tuesday works,” the agent shouldn’t need another reasoning step to separate those two words from the old messages underneath.
The model should spend its effort deciding what to do with the message, not figuring out how email is formatted (email’s messy!)
3. An error should explain the next step. A person can see something fail and go looking for help. An agent needs that guidance where it’s already working, so we added recovery instructions directly to API errors: what permission is missing, what needs correcting, or when to retry.
Lmk if you have any suggestions/ideas to make our API more agent-intuitive!
1. The agent shouldn’t need to open the app. We built the product to be API-first, rather than making agents navigate an inbox on a screen. Every button you see on the console is an API endpoint.
2. Keep the email plumbing out of the model. When someone replies to a long email thread, emails carry the content of the entire thread in the new message, so the agent receives it all as one email. If the reply is just “Tuesday works,” the agent shouldn’t need another reasoning step to separate those two words from the old messages underneath.
The model should spend its effort deciding what to do with the message, not figuring out how email is formatted (email’s messy!)
3. An error should explain the next step. A person can see something fail and go looking for help. An agent needs that guidance where it’s already working, so we added recovery instructions directly to API errors: what permission is missing, what needs correcting, or when to retry.
Lmk if you have any suggestions/ideas to make our API more agent-intuitive!
4
0
25
867
If an agent violates a boundary to complete a task YOU asked it to do, is that a failed task?
This happened to us internally.
An agent was deliberately given an API key that could create email drafts, but not send them.
However, the agent was able to figure out it could schedule these drafts, and since the human wanted the emails “delivered” at some point, the agent wanted to find a way to please the task giver.
So it scheduled a draft for “1 second later,” which is indistinguishable from sending the email.
Granted, our team was able to catch this bug. However, this wasn’t something our traditional bug bot was able to find, but rather something unveiled as a result of agents using the product.
I wonder if there will come a time when something we perceive as malicious intent could be interpreted by these models as simply “completing the task at hand.”
This happened to us internally.
An agent was deliberately given an API key that could create email drafts, but not send them.
However, the agent was able to figure out it could schedule these drafts, and since the human wanted the emails “delivered” at some point, the agent wanted to find a way to please the task giver.
So it scheduled a draft for “1 second later,” which is indistinguishable from sending the email.
Granted, our team was able to catch this bug. However, this wasn’t something our traditional bug bot was able to find, but rather something unveiled as a result of agents using the product.
I wonder if there will come a time when something we perceive as malicious intent could be interpreted by these models as simply “completing the task at hand.”
5
1
33
808
Today, we’re introducing AgentArmor.
Email is one of the largest attack surfaces for agents, making them susceptible to prompt injection attacks through untrusted inbound messages.
We trained a specialized model to detect malicious emails for our users - having helped prevent tracting sensitive bank data, and triggering unauthorized actions for our early beta test users.
Excited for everyone to try it!
Email is one of the largest attack surfaces for agents, making them susceptible to prompt injection attacks through untrusted inbound messages.
We trained a specialized model to detect malicious emails for our users - having helped prevent tracting sensitive bank data, and triggering unauthorized actions for our early beta test users.
Excited for everyone to try it!
30
8
113
5,673
AgentID was an idea birthed from a random event that wasn’t supposed to happen.
Back in March, Datadog reached out saying they had spotted a few accounts signing up with AgentMail addresses and figured we were onboarding our own company.
They were elated at the idea of us en in reality, we had to break the news:
Those weren’t us, those were our CUSTOMERS onboarding their AGENTS to their workspace.
Their response was basically: great, but we’d love some visibility, because one email address is indistinguishable from the next.
That conversation made the missing piece clear. An email address let an agent create an account, but it didn’t tell the platform whose agent it was.
Bingo. Product idea.
Hence, AgentID.com first readme commit was made.
P.S. From launch day 👇🏼
Back in March, Datadog reached out saying they had spotted a few accounts signing up with AgentMail addresses and figured we were onboarding our own company.
They were elated at the idea of us en in reality, we had to break the news:
Those weren’t us, those were our CUSTOMERS onboarding their AGENTS to their workspace.
Their response was basically: great, but we’d love some visibility, because one email address is indistinguishable from the next.
That conversation made the missing piece clear. An email address let an agent create an account, but it didn’t tell the platform whose agent it was.
Bingo. Product idea.
Hence, AgentID.com first readme commit was made.
P.S. From launch day 👇🏼
1
0
54
1,761
The current trend is to create a proprietary authentication protocol to allow agents to auth into programs, and that’s perhaps technically forward.
However, adoption is hindered because you’re faced with a cold start problem where there is no network to accept your auth mechanism. Cooperation amongst 3rd party services is needed to make it meaningfully valuable.
But there is one auth mechanism the entire internet already agrees on as a unique identifier for humans: it’s your email.
As a result of that, once we give agents an email address, they can already talk and communicate and identify with 4 billion other humans.
To the point of network effects, Agent ID is built on an open protocol called OIDC. It’s the same technology that Sign in with Google and Sign in with GitHub use.
So go give your applications a way to accept AgentID - we’ll drive all our agent traffic to you :)
x.com/nikitabier/sta…
However, adoption is hindered because you’re faced with a cold start problem where there is no network to accept your auth mechanism. Cooperation amongst 3rd party services is needed to make it meaningfully valuable.
But there is one auth mechanism the entire internet already agrees on as a unique identifier for humans: it’s your email.
As a result of that, once we give agents an email address, they can already talk and communicate and identify with 4 billion other humans.
To the point of network effects, Agent ID is built on an open protocol called OIDC. It’s the same technology that Sign in with Google and Sign in with GitHub use.
So go give your applications a way to accept AgentID - we’ll drive all our agent traffic to you :)
x.com/nikitabier/sta…
The most important technology problem of the next 5 years:
Creating a broadly accepted standard for agents to identify themselves to service providers, so that providers can adjust the way they interface with clients (as compared to human-based traffic).
In the interim (i.e., for the next 6 months), there will be a cat-and-mouse game that agents will play -- to circumvent detection and maintain their product's utility during this growth phase.
However, this will only be a stopgap and it will not be the terminal state of the world.
3
0
30
1,207
So we’ve spent the last year building email infrastructure specifically for them.
Create an inbox with one API call.
Send and receive emails and attachments, search conversations, and react to incoming messages in real time.
Create an inbox with one API call.
Send and receive emails and attachments, search conversations, and react to incoming messages in real time.
1
0
35
1,705