An Agent Reads My Email
Every morning at five, an agent reads yesterday’s email and writes me a briefing. Most mornings I read the briefing instead of the inbox.
My friend Kyle Reinford just published the pattern he uses - Cloudflare Email Workers catch messages at the edge and file them into R2, so a model never touches his real Gmail. Mine is the same idea from the other end: he guards the front door, I process at home. Apple Mail already syncs my accounts to disk. A script reads the last 24 hours of messages and hands each body to a local model - Qwen3.6-35b-a3b, running in LM Studio on my Mac Studio. No agent harness, no tool loop - just one chat call to localhost per message. All the model gets to do is fill out a tiny form: what is this, does it need me, one-line summary. A renderer turns the day’s forms into a static page. Nothing leaves the house.
That model wasn’t a guess, by the way. It won a bake-off against two other local models on this exact job, judged against Claude Opus. Swept every axis, including speed.
The numbers after 217 days: 22,264 messages processed. 99% were handled without me - mail that never needed me at all. 138 came from actual human beings. Yesterday was typical: 74 arrived, 14 junked, 15 flagged as needing me, and the briefing opened with the two or three that actually did.
When Kyle shared his post, a friend asked the right question: what about prompt injection? Spam is already annoying when it’s written for you. What happens when it’s written for the model reading it?
Honest answer: the model can’t do anything. No tools, no internet. The script rips every link out of a message before the model even sees it, cuts the body down to size, and only accepts that tiny form back. The briefing page renders everything as plain text, so nothing inside an email can turn into live code or a tracking pixel. There’s no clever prompting doing the protecting here - there’s just nothing to hijack.
What strikes me is that three of us landed on the same refusal by different roads. Kyle guards the front door - the model never touches his real account. My friend Chris Wage quarantines the mailbox - a dedicated address that receives only LinkedIn job alerts, parsed by a script with no model in it at all. I starve the reader - full mailbox, but the model gets no tools and no network. Three different trust boundaries, one shared instinct: never hand an LLM the keys.
The worst case? A spam email lies its way into a better spot in my briefing. Annoying - but I’m still the one reading it.
One hard rule keeps it that way: it reads and reports. It never acts. No auto-replies, no auto-unsubscribes, no auto-filing. The day an agent can act on a stranger’s email is the day it gets a real security review - and that day isn’t on the calendar.
That’s my pipeline, written down.