- Adi Singh argued that email gives agents trust because it is already widely recognised, but the same surface carries phishing, prompt injection and spam.
- He said giving an agent your own inbox widens the damage when a message goes wrong, and that existing services may break under the load.
Adi Singh, co-founder of AgentMail, argued on the AI Engineer show that the places where agents earn trust are also places where attackers can reach them. Email is his main example. It gives an agent a recognised identity. It also brings phishing, prompt injection and spam. In his words, "you don't get the trust without owning the risk."
What was said
Singh said agent identity will probably not be issued by a new standard. He thinks agents will accumulate it on surfaces people already use. Email is the one he knows best, and he called it a standard adopted by 5 billion people.
He listed what email already offers. Addresses are widely recognised. Mailboxes keep a history of who messaged whom. Domain records called SPF, DKIM and DMARC show who may send mail for a domain. Spam controls exist too.
The same surface, he said, carries attack risks. These are phishing, prompt injection (hidden instructions in text that an AI may obey) and spam sent outward by the agent itself.
He contrasted this with newer identity proposals such as agent cards, passports and DIDs. He called them technically sound. But he said they work like a key card that expires, and tighter scoping means less access and less adoption.
His practical example was the phone carrier Telnyx. Its agent sign-up flow assumed an email address, which agents often lack. The fix was an API call that hands the agent one, so it does not invent one.
Why it matters
Our reading: an agent with an email address can receive text from anyone who knows that address. Whatever arrives is something the agent may act on. Teams adding email to an agent should treat the inbox as an attack path, not only a feature.
Singh also warned about shortcuts. People sometimes give an agent access to their own inbox or WhatsApp account. He said that leads to wrong messages being sent or received, and "the blast radius for all of these things expanding and exposing." A separate, narrowly scoped address for the agent is one way to shrink that, though he did not prescribe it.
The other side
Singh runs AgentMail, a company built on this idea, so he has a stake in email being the answer. His talk offered no incident counts or measured attack rates. The risks he named were stated, not demonstrated.
He also conceded limits. He said the field is very early and that he was not predicting how agents will identify themselves. He said existing services may break under stress and get overcrowded as agent numbers grow.
One question stays open. He called the newer identity specs sound but too restrictive to drive adoption. The talk did not show how to get adoption without taking on the risks of open surfaces.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: The Next Trillion Internet Users Still Don’t Have an Identity — Adi Singh, AgentMail (2026-10-12)
