Every AI email tool has the same bug. It is not a bug in the model

说明与用途

大多数 AI 邮件工具赋予模型决策权，但仅通过提示限制其行为，导致安全漏洞。提出的架构将感知与权限分离：模型评分四个特征，确定性规则决定处理通道，且不可逆操作需绑定字节级批准，确保安全。

问题

AI email tools give the model authority to decide actions, but rely on instructions in the prompt to constrain it, creating a security flaw where malicious emails can manipulate the model into taking irreversible actions without human approval.

结果

The proposed architecture reduces reliance on expensive LLMs, improves auditability, and ensures irreversible actions are only taken after byte‑level approval, mitigating malicious manipulation.

工作流

• 1. Receive inbound email
• 2. Model parses and scores four features
• 3. Deterministic rule engine maps scores to one of five lanes (interrupt, scheduling, queue, file, never render)
• 4. If lane allows unattended action, a separate flag checks account‑level mode
• 5. For irreversible actions, generate a sha256 receipt of the canonical payload
• 6. User approves by confirming the receipt
• 7. At execution, hash payload again and compare to receipt; if match, perform action, else abort

证据

In my own tool the model never picks the outcome. It scores four features per email — confidence, sender trust, reversibility, urgency — and a deterministic, unit‑tested rule maps those four numbers to exactly one of five lanes

来源

Approval has to bind bytes, not intent. So: approving mints a receipt — a sha256 over the exact canonical payload bytes at the moment you click yes.

来源