One email. One line in white text on a white background. Your AI agent reads it like everything else and acts on it. A smarter model won't reliably stop it. The safe setup:
1. Keep pairing and allowlists on. Never expose the gateway to the internet.
2. Keep approvals on. Run tools in a container.
3. Never give one agent all three powers.
Claude Code can fix how a draft sounds without touching what it claims. Each issue comes with its line and the reason, and one line confirms the facts did not change. 3 steps:
2. It writes one plain markdown voice file. Every trait quotes the sample it came from.
3. Paste a draft: each issue is flagged with its line and the reason, and the facts stay locked.
A smarter model won't reliably spot the hidden line in a prompt injection. None of OWASP's recommendations for AI agents depend on it. The setup that does work:
1. Keep pairing and allowlists on. Never expose the gateway to the internet.
2. Keep approvals on. Run tools in a container.
3. Never give one agent all three powers.