The costliest attack on an agent is not clever. It is large.

The costliest attack on an agent is not clever. It is large.

When people talk about agents that read messages from outside, they often focus on prompt injection: someone hiding an instruction in an email that tells the model to forget its rules. That matters. But there is a less sophisticated attack you should expect just as much: sending a lot of messages.

Every message a model reads costs tokens. So an agent with a public address can be drained without anyone doing anything clever. It does not even have to be malicious: two automated systems replying to each other (an out-of-office message answering another out-of-office message) can create a loop that never ends.

That is why every entry point has four limits, enforced in code rather than left to expectation:

1. A limit per sender, per hour. An ordinary person sends a handful of messages. Someone who sends far more first gets a fixed, brief reply that does not involve a model. That costs nothing.

1. Then silence. After that fixed reply, there is no further answer. Anyone who keeps trying has nothing more to respond to.

1. A surge detector. If an unusual number of new senders arrive in a short time, the address switches to “known senders only” for a few hours. Unknown senders get the fixed reply once, then nothing. I also get an alert so I know it is happening.

1. No reply to an automated message. An out-of-office notice gets no response, and a second message from the same sender does not trigger anything new. That keeps a loop to a single round.

The key design choice is to put the cheapest defence first. The fixed reply needs no model, so a flood of messages costs almost nothing. Only messages that stay within the limits reach the model.

Think of a sluice: the point is not to stop the water, but to control how much gets through each hour.

I test it, too. I send a fixed set of messages, including a flood, and check that the number of outgoing replies stays within the limit. That often teaches you something: a limit was missing, or one entry point had it while another did not.

If an agent or automated system of yours can be reached from outside, what happens when a hundred messages arrive in an hour?

#AIagents #Security #AI #Reliability

All pieces