HTML vs Markdown for AI agents
Markdown for model I/O, sanitized HTML for humans—token cost and XSS risk make raw HTML a poor default for agents.
Discuss this post in AI
Send a pre-filled prompt to ChatGPT, Claude, Gemini, or Perplexity — get a summary, ask follow-ups, or compare ideas from this guide.
Email is historically HTML. Models are not browsers. If you feed an agent raw HTML from inbound mail, you pay in tokens, invite prompt injection through hidden text, and risk XSS when that content is later rendered for a human. Pattern Automation’s default posture: markdown for model I/O, sanitized HTML only where a person must see layout.
Token cost
HTML emails carry tables for layout, tracking pixels, inline CSS, and duplicated plain-text parts. Most of that is irrelevant to the decision the agent must make. Converting to markdown—or to a structured extract of subject, from, date, body text, and attachments—shrinks context and improves focus.
Prefer attachment extraction over pasting encoded blobs into the prompt. Agent Inbox supports reading and extracting attachments so the skill works on content, not MIME noise.
XSS and phishing when rendering
Anything you show a human operator can become an attack surface. Scripts, unexpected javascript: links, and misleading UI in HTML should never execute in an admin tool. Sandbox the preview. Strip active content. Display link targets plainly before navigation. Ask before following links that change state—unsubscribe endpoints, approve buttons, payment confirms.
Inbound HTML can also hide instructions for the model in white-on-white text or HTML comments. Treat untrusted mail as hostile input. Separate “text for the model” from “HTML for the preview.”
Markdown as the agent lingua franca
Skills, drafts, and Ask cards work well in markdown: readable, diffable in git, cheap in tokens. Generate outbound plain text or carefully templated HTML from markdown after approval. Do not let the model emit arbitrary HTML that bypasses sanitizers.
| Layer | Format | Reason |
|---|---|---|
| Model input | Markdown / structured text | Tokens, clarity |
| Model draft | Markdown | Reviewable |
| Human preview | Sanitized HTML | Familiar layout |
| Stored raw | Original MIME | Forensics |
Neuro OS practice
Run conversion and sanitization in the sandbox. Policy blocks execution of remote scripts. Connectors brokered server-side should not fetch arbitrary URLs from mail without Ask. Self-host when previews and raw mail must stay in-region for 152-FZ.
Related reading: rendering email safely, email as memory, build email agents.
HTML is a delivery costume for human clients. Markdown is a working language for agents. Keep them in different pipes, and never collapse “render for a person” into “trust for a model.”
Outbound templates
When a human expects branded HTML, keep templates in version control with placeholders. The model fills markdown fields; a renderer merges them into the template after Ask. That prevents free-form HTML from the model and keeps legal footers, unsubscribe paths, and identity blocks consistent.
Plain-text alternatives still matter for accessibility and for recipients that strip HTML. Generate both from the same approved content when the stream is customer-facing.
Injection examples to train reviewers on
Operators should see examples of hostile mail: white text instructions, comment-hidden prompts, fake “security” buttons, and attachments named like invoices. The goal is not paranoia theater. It is shared vocabulary for why the pipeline converts before it trusts. Pair training with the controls in rendering email safely.
Measurement
Track average tokens per inbound event before and after HTML stripping. Track Ask rejections caused by suspicious links. Track incidents where a human preview showed active content. Those metrics justify the markdown-first rule better than taste debates.
Agent Inbox gives each role a mailbox people can reply to, with forwarding into Neuro OS when a human must see the thread. Outbound mail defaults to Ask. Run the role on Neuro OS. To scope the first inbox, get started.