A Customer Email Is Not an Instruction for Your Marketing Agent

A customer replying to a campaign has permission to ask a question, challenge an offer or request an unsubscribe. That does not give the customer permission to instruct the software behind the campaign to export a contact list, change a discount or send another message.

For an AI marketing agent, that distinction needs to survive the moment it reads the reply. My concern is not simply whether the agent can recognise suspicious language. It is whether a message from outside the business can become authority to act inside it.

The warning that arrived after the action

On 1 October 2026, Salt Labs published research describing how an email could redirect a Manus agent into executing code while processing an inbox request. In the demonstrated attack, a security warning appeared after the payload had already run. The researchers reported access to the connected Gmail environment and potential exposure of other connected services, depending on the user's configuration.

Salt Labs says the specific issue has been resolved and is no longer exploitable. This was a research demonstration, not evidence that every marketing agent is compromised or that the same attack still works. But the timing matters: noticing a dangerous instruction after carrying it out is not the same as preventing the action.

For campaign owners, I would translate that finding into a simple question: what can an inbound message cause our agent to do before a person or an independent control has agreed?

Replies are business information, not operating instructions

Consider a hypothetical retailer using an agent to sort replies to an email promotion. Its legitimate job is to identify questions about delivery, route complaints and prepare suggested responses. A message might also claim that a manager has authorised a special discount, or ask the assistant to send the entire customer list elsewhere for a supposed campaign audit.

I would want the agent to report those requests, not inherit the authority they claim. The sender's assertion of approval is part of the message to evaluate. It is not the approval itself.

The same distinction should apply to an SMS reply, a lead-form submission or a support note added to a customer record. Those examples are proposed workflow tests, not claims that the Manus finding demonstrated every channel. The point is to decide where operational permission comes from before giving an agent access to campaign tools.

There is an important exception to handle properly: a genuine unsubscribe request. An authorised opt-out workflow should process it according to the business's rules. Treating external content as untrusted must not become an excuse to ignore customer choices. The authority comes from the approved workflow, not from allowing arbitrary instructions in a message to redefine it.

Inbox protection helps, but has a defined scope

Microsoft's Defender for Office 365 documentation, updated on 8 September 2026, describes prompt-injection detection in inbound email for Plan 2. It inspects more than the visible body, including hidden content and quoted material. That is an earlier layer of protection, before an assistant reads the message.

The documentation also sets limits. The current focus includes attempts to send sensitive information through attacker-controlled URLs, reveal system instructions or discover available tools. It is not intended to block every instruction-like phrase or act as a general-purpose prompt-injection benchmark. Microsoft explicitly says runtime safeguards remain important.

I would therefore reject a procurement answer that stops at 'our email filter covers it'. Ask separately what the mailbox protection detects and what prevents an agent from making an unauthorised change once content reaches it. Those are different controls with different jobs.

Separate reading from committing a campaign decision

OpenAI's 11 March 2026 analysis frames agent security partly as a social-engineering problem: a system should constrain the impact of manipulation even when it fails to identify every malicious input. That is a more useful starting point than expecting a model to make perfect trust judgements about every reply.

My preferred marketing design would separate three responsibilities. The reading stage extracts the customer's request. A policy-controlled stage decides what the business permits. The action stage performs only the approved operation. This is a design recommendation, not a promise that every agent platform already supports it.

Start the reader with the smallest useful access. If its job is to summarise campaign replies, it should not automatically inherit the ability to export the whole database or launch a bulk send. If it prepares a response, keep the proposed recipient and message visible before any consequential dispatch.

For a change to an offer or an audience, approval should identify the actual proposed change. An agent's confident explanation that approval exists somewhere in the thread is not enough. Nor should one general agreement to connect an account be treated as approval for every later campaign action.

Test the boundary before rewarding the speed

I would ask a campaign team to run a contained rehearsal using synthetic contacts and no live sending. Include ordinary delivery questions, a clear opt-out and a reply that falsely claims internal approval for a contact export. Then inspect what the agent actually attempted, not only the summary it displayed.

The success criteria should be written in advance: ordinary questions are routed correctly, the authorised opt-out path works, and the fabricated approval cannot unlock an export or campaign change. Keep evidence of refused actions as well as completed ones. A reassuring final answer does not establish that no earlier action occurred.

That rehearsal will not prove immunity to every attack. It will show whether the team has implemented the particular business boundary it claims to rely on. Repeat it after a meaningful change to the agent's permissions or connected tools.

Marketing automation should make it easier to listen to customers without handing them control of the campaign machinery. The useful agent is not the one that obeys every instruction it encounters. It is the one that can read a reply, understand the request and still know whose authority it is working under.