Designing an email AI assistant to resist prompt injection by removing send capabilities

·1 views

Connecting an AI assistant to a mailbox exposes the model to text written by any sender, which can contain hidden instructions. The author's Fezola MCP server responds by disabling direct sending entirely, so the send tool is never registered and cannot be invoked. Instead, the assistant can only save replies and forwards as drafts that the user reviews before anything is sent. Chat connectors are read-only, and state-changing tools are annotated so clients can request confirmation. The authors note these measures limit only the mail tools, so other connected tools in the same conversation could still be misused.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Mori Period App Recomputes Predictions Instead of Storing Them

The developer of Mori, an offline period tracker with no account, explains why the app does not save its predicted dates in a database. Stored predictions go stale when past entries are corrected, can create mismatches between screens, and add extra data that must be deleted. Instead, the app stores only the dates users mark and recalculates predictions from that history using an explicit as-of date. The developer notes this makes results reproducible and simplifies deletion, at the cost of recomputing on each read. The phone is the only copy of user data by default, so keeping a single source of truth is treated as important.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study finds no detectable effect of a book launch on AI search citations

A researcher tracked how answer engines with web search responded to 16 fixed questions about a new author, scoring answers on a fixed scale. After the author's first novel was released on 8 October 2026, the study compared a drift-adjusted baseline with the following month. The headline score rose by 1.38 percentage points, but the 95% interval (-3.59 to 6.68) includes zero, so the pre-registered null hypothesis was not rejected. Neither the direct-answer nor the recommendation channel showed a meaningful shift, and the predicted earlier pickup in direct answers was not supported. The author notes limitations including a single-author design with no comparison group, incomplete Gemini data, and possible unrelated changes to provider search systems during the same period.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Valve améliore la qualité du streaming SteamVR, un enjeu notable pour les personnes amblyopes

Valve a publié une mise à jour bêta de SteamVR qui améliore la netteté, la stabilité et la fidélité de l'image en streaming sur les casques autonomes compatibles Steam Link, dont Meta Quest, HTC Vive Focus et PICO. Pour la plupart des utilisateurs, il s'agit surtout d'un gain de confort visuel. Le texte souligne qu'une qualité d'affichage stable est essentielle pour les personnes atteintes d'amblyopie, car elle conditionne l'efficacité des exercices d'entraînement binoculaire. L'article présente aussi Amblyotube, une application Meta Quest de rééducation visuelle développée par Seven Sports, qui envoie deux flux visuels distincts à chaque œil pendant la lecture de contenus vidéo. L'éditeur précise qu'il s'agit d'un outil complémentaire, recommandé dès 13 ans à raison de 30 à 40 minutes par jour, et non d'un traitement médical.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bounded Replay for Realtime Voice Lobbies: Recovering Go Clients Without Duplicates

The article argues that offline replay should be treated as a bounded recovery mode rather than a second live session in realtime gaming voice lobbies. It recommends a stable channel identifier and explicit client-server ownership so reconnects do not cause duplicate joins, phantom speakers, or audit gaps. Monitoring should track authentication, subscription, and business events as separate streams that share a correlation ID but not a success counter. On reconnect, a client compares its last stable identifier with the server's authoritative snapshot, replaying only newer events or resubscribing cleanly if the identifier falls outside the retained window. Because transport may deliver at least once, operations such as joining or muting are made idempotent using client-generated operation IDs.

0 comments Read more at DEV Community