Email Webhook Security for Agents

Threat model

Inbound email can carry spoofed sender identity, malicious attachments, prompt injection, forged reply history, oversized payloads, and replayed webhook events. The webhook handler should verify the provider event before any model receives the content.

Webhook validation checklist

Validation should happen before enqueueing. If the provider cannot sign events, put the webhook behind an allowlist, shared secret, or proxy that adds a verifiable boundary.

• ok Verify signature, timestamp, and payload body exactly as received.
• ok Reject stale timestamps and duplicate provider event IDs.
• ok Require a provider message ID, recipient mailbox, sender, subject, and body field.
• ok Store raw payload with retention limits for debugging.
• ok Normalize HTML and text separately before extraction.
• ok Route failed validation to a dead-letter queue, not to the agent.

Before model input

The safest pattern is parse, normalize, extract, validate, then pass a narrow structured object to the model or workflow. Raw MIME should be available for audit, not the default model input.

• ok Remove tracking pixels, remote images, and invisible text.
• ok Separate latest reply from quoted history.
• ok Treat links and attachments as references until scanned or fetched safely.
• ok Extract intent and entities into a schema.
• ok Require human review for low confidence, money movement, new recipients, or permission changes.

Outbound approval

Inbound security is incomplete if the outbound path is automatic for every request. Agent email systems should require approval for first-time recipients, external domains, billing changes, legal language, and any response that includes generated claims about the product.