The attacker doesn't need your password. They have your inbox.
Every AI assistant that reads email shares one threat model, usually unstated: the primary input is text written by strangers, delivered free, from anywhere, by design. A crafted message that steers the model isn't a breach of anything — it's email working as intended. Here are the four layers Klorn puts between that message and anything irreversible, and an honest accounting of which are promises and which are properties.
Layer 1 — Wrapper hygiene (a promise, kept tidy)
Every email subject, body and third-party string is wrapped in <untrusted_content> markers before it reaches a model, and pre-existing wrapper tags are stripped from the message first — so a sender who includes </untrusted_content> in their email cannot close the wrapper and promote their text to instructions. The classifier's system prompt states that anything inside the tags is data, and that a message arguing about its own classification is an injection attempt.
Be clear about what this is: instructions to a model are a policy. A sufficiently clever message may still steer scores. This layer raises the cost of the attack; it cannot make the attack impossible, and any vendor telling you otherwise is describing a prompt.
Layer 2 — The model has nothing to steal
The structural defense is what the model is allowed to output: four numbers. Confidence, sender trust, reversibility, urgency — a deterministic, unit-tested rule maps them to one of five lanes. So the worst a fully-steered classifier can achieve is a wrong lane, and the failure direction of a wrong lane is pinned by a CI-enforced test: urgent mail never degrades to the hidden lane, only to the visible queue. A hostile email can waste your attention. It cannot spend your authority.
Layer 3 — Irreversible actions bind bytes, not intent
Send, permanent delete and forward-external cannot ride on model confidence at all. Approval mints a receipt: a sha256 over the canonical payload — recipient, subject, body — at the moment a human says yes. At execution the payload is re-hashed and compared; any drift between what you approved and what is about to run throws, and the action is refused. The verifier is hash comparison in the execution path — it cannot read English, so there is no phrasing that gets past it. This one is a property.
Layer 4 — Autonomy is opt-in, twice
The assistant's default mode is suggest-only. Unattended replies require the account-level AUTO mode and a per-message eligibility flag (reversible, high-confidence, trusted sender, not urgent) — and every unattended send still writes a receipt. Classification never silently becomes action.
What's still missing, stated plainly
The repo's SECURITY.md maps each claim above to the test that enforces it and to what would falsify it — and it also names the gap: there is no end-to-end adversarial corpus yet, fixtures that start from a hostile email and assert containment across the whole path. That's written down rather than hidden, because the difference between a security page and security is whether the gaps are on it.
Try Klorn free