Direct answer
Check an Email for Prompt Injection Before Your AI Reads It
Paste or pipe the email into prompt_shield before your AI acts on it, and act only on a clean result. An email is untrusted text: anyone who can send you mail can hide instructions inside it aimed at your agent rather than at you. Zambo's prompt_shield scans that text for prompt injection before the agent reads it as instructions, and returns a verdict you can check.
Updated October 20, 2026.
Why inbox agents are exposed
An agent with inbox access reads mail the way it reads your instructions, in the same stream of text. A sender can exploit that: white text on a white background, instructions buried in a forwarded thread, a fake system notice, or a polite request that quietly tells the agent to forward files, follow a link, or ignore your rules. You would spot some of these on a careful read. The agent, reading at machine speed across hundreds of messages, is the softer target, so the check has to happen before the content reaches it as instructions.
Run the scan
- Get the raw text. Take the full email body, including quoted and forwarded parts, because injections hide in the parts a summary would skip.
- Send it to prompt_shield. With Zambo connected over MCP at zambo.dev/mcp, ask your AI to run prompt_shield on the text before summarizing or acting on the message, or pipe the text to the tool from your own automation.
- Read the verdict before anything else. The scan returns a result for that exact text. Only a clean result goes on to the agent as content it may act on.
- Keep the receipt. The scan itself leaves a Zambo receipt, so you can show later what was checked and what the result was, checkable at zambo.dev/verify.
Interpret the result
- Clean: no injection patterns found in that text. The agent may read and act on the email as ordinary content, with the usual care for any untrusted sender.
- Flagged: the text contains instruction-like content aimed at an AI reader. Do not let the agent act on it. Read the email yourself, as a human, and handle it manually if it needs handling at all.
- Unclear or partial: treat it as flagged. A scan that could not see the whole message, for example text locked inside an image attachment, has not cleared the message.
Automate it
The durable setup is a rule, not a habit: every email an agent touches passes prompt_shield first, flagged mail goes to a human review folder, and clean mail flows on. Put the rule in the agent's standing instructions and in any workflow that feeds it mail, so a new session inherits the check instead of rediscovering the risk. New senders and forwarded threads deserve the scan most, but bulk scanning everything is simpler and safer than judging sender by sender.
For $0.99, a Day Pass covers 24 hours of full use. Ongoing use is the Zambo Pass at $29 a month or $290 a year, and $19 a month for $ZAMBO holders. Humans pay by PayPal or card through PayPal; agents pay with USDC on Base via x402.
Honest limits
prompt_shield checks text for prompt injection patterns. It cannot see instructions hidden inside images or attachments it was not given, and no scan catches every novel phrasing, so a clean result lowers risk rather than removing it. The scan also says nothing about whether an email is honest: a message can pass the injection check and still be a plain scam, which the scam check page covers.
Frequently asked questions
How do I check an email for prompt injection?
Take the full email text, including quoted and forwarded parts, and run it through Zambo prompt_shield before your AI reads or acts on the message. The scan returns a verdict for that exact text. Act only on a clean result; treat a flagged or partial result as unsafe for the agent and read that email yourself.
What is prompt injection in an email?
Prompt injection in an email is hidden or embedded instruction text written for an AI reader rather than the human recipient. Examples include invisible text telling an agent to forward files, a fake system notice inside a forwarded thread, or a request that quietly overrides your rules. The sender needs nothing but your address to try it.
Why scan email before an AI reads it?
An agent reads email in the same text stream as your instructions, so malicious instructions inside a message can be mistaken for directions it should follow. Scanning first separates content from commands: the email is checked as untrusted text, and only a clean result is allowed to reach the agent as material it may act on.
What should I do if prompt_shield flags an email?
Do not let the agent act on that message. Read it yourself as a human, looking for the instruction-like content the scan found, and handle the message manually if it needs handling. Most flagged mail from unknown senders can simply be deleted. Keep the scan receipt if the message matters, so the check itself is on record.
Can prompt_shield tell me if an email is a scam?
Not by itself. prompt_shield checks for prompt injection, which is one attack aimed at AI readers. Scam checks look at sender signals, links, urgency, and payment requests, a different set of red flags. For a suspicious message, run the injection scan for your agent's safety and a scam review for your own.