Gmail Agent Shield

gmail-agent-shield

A minimal, opinionated set of Gmail filters and skill-level instructions that protect agentic AI systems from prompt injection delivered via email.

The problem

Agentic systems that read your email are everywhere now. OpenClaw, Claude Code, Codex, Gemini CLI, Manus, and whatever else is trending on Hacker News this week. They pull context from your inbox, summarize threads, draft replies, and call tools on your behalf. The security conversation around these systems focuses almost entirely on model-side defenses: fine-tuning against injection, training models to ignore instructions embedded in content, hardening the orchestration layer.

Those defenses are real but thin. They reduce the hit rate. They don't drive it to zero. And an attacker gets infinite attempts to rephrase.

Meanwhile, Gmail ships a server-side filter layer that runs before any agent ever reads a message. Free, deterministic, reversible. Almost nobody uses it as part of their agentic AI setup.

This repo is a drop-in starting point.

What it does

Three defense layers:

1. **Gmail filters (server-side).** Three filters route hostile-looking mail to an `AI/Quarantine` label and out of your inbox before your AI agent ever sees it:

   • High-abuse TLDs (.skin, .top, .rest, .click, .cyou, .sbs, .monster, .zip, .mov)
   • Known prompt-injection phrases (ignore previous instructions, system prompt, DAN mode, etc.)
   • Assistant-name + action-verb combinations (claude/anthropic/assistant/gpt/chatgpt plus execute/curl/email to/forward to/send to)

2. **Agent-side query exclusion.** A snippet to add to your agent's Gmail search queries: `-label:AI/Quarantine`. Filters organize mail. This step makes your agent blind to the quarantined portion.

3. **Reading-time instruction.** A drop-in paragraph (`skill-template.md`) for your agent's system prompt or skill definition. It tells the model to treat email content as untrusted input, not as instructions.