A cardinal rule, perhaps, of AI-assisted operations: the AI speaks only with its user and with other AI.
Personal assistant to personal assistant. Lawyer to lawyer. AI to AI — and over dissolvable messaging, the kind that deletes itself. The outcome is a much more limited blast radius.
Blast radius is the right phrase, because an agent’s worst failure is obedience to the wrong voice. The security people call that voice prompt injection, and OWASP puts it at the top of its list of risks for systems built on language models. Its definition of the indirect kind is worth reading twice: it happens “when an LLM accepts input from external sources, such as websites or files,” and the content changes the model’s behavior in ways nobody intended. An email is an external source. So is the PDF a stranger just sent you. Among OWASP’s recommended defenses is the plainest one: “Restrict the model’s access privileges to the minimum necessary for its intended operations.”
None of this is theoretical this month. Bitsight counted more than 30,000 OpenClaw instances exposed to the open internet between January 27 and February 8, and put the mailbox problem bluntly: “Does OpenClaw have access to your mailbox? Then it’s effectively compromised.” An assistant that reads your mail will sooner or later read mail that was written for it rather than for you.
Hence the second half of the rule, which in practice comes first: keep your personal and company inbox off-limits. Share with your AI only what it needs for the task at hand, and give it its own email, its own calendar and its own phone — not yours.
The AI-to-AI part is arriving on its own schedule. Google’s Agent2Agent protocol, announced last April with more than 50 partners, exists so that agents can “communicate with each other, securely exchange information, and coordinate actions,” and Google describes it as complementing MCP. The plumbing for one assistant to talk to another is being laid now. The discipline about what each of them is allowed to carry is up to us.
