Rendering email safely
Sanitize, sandbox, never execute remote scripts, and Ask before following links that change state.
Discuss this post in AI
Send a pre-filled prompt to ChatGPT, Claude, Gemini, or Perplexity — get a summary, ask follow-ups, or compare ideas from this guide.
Email is an untrusted document format. Anyone can send HTML that looks like your bank, your CRM, or your internal admin. Agents that read mail—and humans that approve agent drafts—need a rendering path that assumes hostility.
Sanitize before you show
Strip scripts, event handlers, exotic CSS, and active content. Rewrite or neutralize dangerous URLs. Prefer a allowlist of tags for operator previews. Keep the original MIME for forensics; never require the original to be executable to be useful.
Sandbox the preview
Render in an isolated context with no shared cookies for production apps. Block mixed content that pulls remote scripts. Disable automatic remote image loading when policy requires, or proxy images through a scanner. Neuro OS sandboxes are the right place for conversion and extraction jobs—not the operator’s main browser profile.
Never execute remote scripts
If a message needs JavaScript to “view the claim,” it is not safe input for an agent pipeline. Extract the text and attachments through Agent Inbox APIs instead. Attachments get their own scanners; macros are not tools.
Ask before state-changing links
Many phishing mails succeed because a single click approves access, confirms a payment, or OAuths a third party. Operator UIs should display the raw URL and require Ask—or an explicit human gesture—before navigation that can change state. Agents must not auto-follow those links to be helpful.
Separate model input from human preview
Convert to markdown or structured fields for the model. Show sanitized HTML to people. Hidden HTML instructions should not reach the prompt. See HTML vs Markdown.
Forwarding does not make mail safe
A forwarded thread can still contain payloads. Treat forwarded inbound the same as direct inbound. When the agent forwards to a human for Ask review, include warnings if the thread failed sanitization checks.
Policy defaults on Neuro OS
- Writes and sends: Ask
- Arbitrary URL fetch from mail: Ask or Block
- Credential export: Block
- Self-host when previews and raw storage must remain under your key management and 152-FZ constraints
Safe rendering is not optional polish. It is how email agents avoid becoming phishing amplifiers. Pair this with deliverability for outbound trust and email threading for correct conversation handling.
Attachment handling
Render or extract attachments in the sandbox with size limits and type allowlists. Prefer text and PDF extraction over opening active office macros. Quarantine unknown types for human review. Never pass raw executable bytes to the model as “context.”
If an attachment is the business object—a signed act, a bank slip, a BOM—store the extract and the hash of the original. Memory should cite the hash so later disputes can recover the exact file.
Operator UX requirements
Show From, Reply-To, Return-Path, and authentication results beside the preview. Display link URLs in full. Make “open link” an explicit action. Make “approve send” a separate action. Conflating reading with approving is how mistakes ship.
Incident response
If a phishing message reaches an agent and a human almost approved a bad send, treat it like a security incident: preserve the MIME, rotate any touched credentials, review allow lists, and update the skill’s checks. Safe rendering reduces frequency; process reduces impact.
Agent Inbox gives each role a mailbox people can reply to, with forwarding into Neuro OS when a human must see the thread. Outbound mail defaults to Ask. Run the role on Neuro OS. To scope the first inbox, get started.