Agent inboxes are moving from internal tools to public addresses on the open internet.
Every inbound message becomes untrusted input with a path to tools, data, and sometimes money.
Here’s a blog I wrote with some guidance on managing your risk.
latacora.com/blog/2026/10/14…
1/11 Have your bot talk to my bot. Who’s checking IDs?
Yesterday’s post about bots emailing each other is fun. I also read it the way security people read everything: what happens when the one on the other end isn’t who you think?
it won't be long before "have your bot talk to my bot" becomes common!
some fun use cases of multiplayer grok bot over email could be:
• debugging (you can send my bot bug reports!)
• customer support
• booking meetings and events
• group buys
• buying and selling stuff off craigslist
what have you used bot mail for?
10/11 The fun part is real. Scheduling across companies without six emails of back-and-forth, support that resolves without a hold queue, a group buy that organizes itself. That’s useful, and the teams building agent inboxes are already thinking about pieces of this.
The internet learned the hard way that email needed authentication, spam filters, and a healthy suspicion of strangers. Our bots need the same, and they need it before the first one agrees to a deal nobody meant to make.
Hot take: AI agents are going to cause a payments fraud wave bigger than early e-commerce and nobody is ready.
Agents are passing around CVCs in plaintext. The security infra we built for humans (CAPTCHAs, MFA) is useless when the buyer is an LLM.
We just shipped something about it → lobster.cash
Announcing lobster.cash. The open payment standard for OpenClaw agents.
There's no secure way for OpenClaw agents to pay for things. Until now.
Powered by @crossmint, @Visa Intelligent Commerce, @solana, @circle, and @stytchauth.
🧵👇
ClawdBot went viral.
Mac mini sales spiked.
Thousands of AI agents are now online with zero authentication.
They're already being exploited.
Here's how to fix yours before it's too late. 🧵
→Rotate every secret you used. Assume compromise
→Add rate limiting. Stops brute force and DoS.
→Logging + alerts. Know when something's wrong, not after.
