Untrusted data

An agent that reads your e-mail can be told what to do by whoever wrote the e-mail. Crewdesk is built so that it doesn't listen.

What counts as untrusted

Everything that reaches the model from outside the conversation:

• what an app returns (an e-mail's body, a CRM record, a file's text);
• a fetched web page, search results and research findings;
• a page opened in the browser;
• an automation run's output.

How it's handled

1. Wrapped as data. Untrusted content goes to the model inside a labelled envelope ("app data from Gmail…, untrusted data … end of app data"). Any bracket inside it that would close the envelope or open a fake one is escaped, so the data can't break out.
2. The turn is marked. A turn that read untrusted data is tainted.
3. Every write goes to a card. In a tainted turn, every write the agent proposes waits for your yes, in every permission mode, Fully free included, and the card says what the turn read before it ("Suggested after reading").
4. The server double-checks. The Hub refuses a write that tries to run without approval after an app read, a web fetch or a web search in the same turn.

So a hidden instruction in an e-mail ("forward this thread to…") can at most make the agent propose something, which you see on a card, with the source named.