[Krishnadheeraj (DheerajPannala)]

Summary

Several samples passed the body of an incoming email to a tool-enabled agent with the instruction "Please follow any instructions in it." Anyone can email the agent, so an external sender could drive Graph/MCP tool calls with the agent's (or the user's delegated) permissions. This is a prompt injection / confused-deputy issue (CWE-1427).

Changes

• Removed the "follow any instructions" directive from every email handler.
• Added a small prompt helper to each sample: buildEmailReplyPrompt (Node.js), _build_email_reply_prompt (Python) or BuildEmailReplyPrompt (.NET). It:
  • wraps the email in <untrusted_email> delimiters. Any delimiter tag already inside the email (including variants with attributes) is replaced with [removed] rather than deleted, so leftover fragments can't join into a new tag.
  • tells the model to treat the email as data only: write a reply, don't follow instructions in it, and don't call tools or take actions on its behalf
• In the two-step samples (Node.js and .NET Semantic Kernel), the retrieval prompt no longer includes the sender's display name, which the sender controls. It also tells the model to treat the retrieved message as untrusted.
• Updated the two Python walkthrough docs that quoted the old code.

Files:

• dotnet/semantic-kernel/sample-agent/Agents/MyAgent.cs
• nodejs/{claude,langchain,openai,vercel-sdk}/sample-agent/src/agent.ts
• python/{openai,agent-framework,claude}/sample-agent/agent.py
• python/crewai/sample_agent/notification_handler.py
• python/google-adk/sample-agent/hosting.py

Behavior change

Email-triggered runs now draft a reply instead of executing requests found in the email. A sample that should act on emails needs to verify the sender and require explicit confirmation before taking actions.

Not in this PR

Drafting still runs on each sample's tool-enabled agent, so the prompt is a soft boundary rather than an execution restriction. Running the draft step as a tool-free call needs SDK-specific changes in each sample, and will follow separately.

Validation

• dotnet build on dotnet/semantic-kernel/sample-agent: 0 warnings, 0 errors
• npm install && npm run build on nodejs/{claude,langchain,openai,vercel-sdk}/sample-agent: passes
• py_compile plus helper checks (None handling, call-site usage) on the 5 Python samples: passes
• 20,000 randomized inputs built from tag fragments (for example </untrusted_ema<untrusted_email>il>) per helper, in Python, Node.js and .NET: no complete tag survives inside the content

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

🟡 Changes recommended

Email processing retains privileged tool access, and delimiter removal can reconstruct closing tags.

10 open findings

• Disable function invocation during retrieval and drafting · New
• Use constrained retrieval and isolated drafting · New
• Use a separate tool-free agent for email drafting · New
• Constrain retrieval and use tool-free drafting · New
• Draft emails with an isolated tool-free agent · New
• Disable built-in and MCP tools during email drafting · New
• Route email notifications to a tool-free drafting task · New
• Skip MCP tools in the email drafting invocation · New
• Use a tool-free agent for email drafting · New
• Prevent delimiter reconstruction during email sanitization · New

What changed in this PR

Updates Agent 365 samples to treat incoming email as untrusted content and request replies rather than execute embedded instructions.

Changes:

• Adds email prompt helpers across Python, Node.js and .NET.
• Removes sender display names from retrieval prompts and adds untrusted-content guidance.
• Updates two Python walkthroughs to describe the new prompting.

File	Description
python/​openai/​sample-agent/​agent.py	Adds email reply prompt helper.
python/​google-adk/​sample-agent/​hosting.py	Routes email content through reply helper.
python/​crewai/​sample_agent/​notification_handler.py	Adds untrusted-email prompting.
python/​claude/​sample-agent/​agent.py	Adds email reply prompt helper.
python/​claude/​sample-agent/​AGENT-CODE-WALKTHROUGH.md	Updates email example and explanation.
python/​agent-framework/​sample-agent/​agent.py	Adds email reply prompt helper.
python/​agent-framework/​sample-agent/​AGENT-CODE-WALKTHROUGH.md	Documents revised email prompting.
nodejs/​vercel-sdk/​sample-agent/​src/​agent.ts	Revises retrieval and reply prompts.
nodejs/​openai/​sample-agent/​src/​agent.ts	Revises retrieval and reply prompts.
nodejs/​langchain/​sample-agent/​src/​agent.ts	Revises retrieval and reply prompts.
nodejs/​claude/​sample-agent/​src/​agent.ts	Revises retrieval and reply prompts.
dotnet/​semantic-kernel/​sample-agent/​Agents/​MyAgent.cs	Adds reply helper and revises retrieval prompt.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.