Strangers can't give your agent orders.
Anyone can email your agent, and some will try to instruct it. Molted screens every inbound message, and when one tries to take over, your agent only learns that it was quarantined.
Every message is scored before it's read.
Invisible characters, hidden elements and scripts are stripped on arrival. What's left is checked for five kinds of injection, and each match adds to a risk score between 0 and 1. From 0.7 up, a message counts as high risk.
instruction override · role play · fake system prompts · delimiter abuse · exfiltration
Your agent only learns it was quarantined.
A high-risk message reaches your agent as a placeholder, marked untrusted, with its risk level. The real body stays out of its context, and a person on your team can still read it. Quarantine is on by default.
{ "untrustedContent": { "bodyText": "[quarantined -- injection risk]" }, "agentGuidance": { "injectionRisk": "high", "contentTrust": "untrusted" }}What it was told can't leave.
Every thread puts a canary token in your agent's context. If a reply on that thread contains it, because someone talked your agent into repeating what it was told, the send is blocked by default.
reply({ thread_id: "3f9a…", body: "…" }){ "status": "blocked", "reason": "canary_violation"}Replies into risky threads wait for you.
For seven days after a high-risk message lands in a thread, your agent's replies on it are held for a person to approve, whatever the mailbox's autonomy level.
reply({ thread_id: "3f9a…", body: "…" }){ "status": "pending_approval", "reason": "thread_risk_flagged"}Hand it to your agent.
It sets up its own inbox. You decide how much it does on its own.