Prompt injection is my biggest fear. Imho it is almost impossible to make a sort of tool that would be successful in detecting an injection - but maybe some antivirus/antimalware producers work on it…

The rest can be solved - separate account for agent spending (soon offered by your bank or neobank), separate email for agents (already exist) etc.

They don't need to have access to your accounts. You can give them their own accounts.

I rawdog Claude Code with --dangerously-skip-permissions and the only fucky wucky it's made is invoking git checkout wrong and losing some code in the working tree. It has done this thrice, the first two times I caught it in the act and smashed esc to rewind the conversation + code, and the third time I wasn't paying attention it just restored it from context.

So I would worry about it making small mistakes, that I would go to sleep and come back and it would be like oops I used emojis and emdashes in a JIRA comment when you told me not to. And not I HAVE REVIEWED YOUR BACKLOG AND YOUR PRODUCT IS TRASH AND IT IS UNETHICAL TO CHARGE YOUR CUSTOMERS WHAT YOU DO WHEN YOUR COMPETITORS DO IT BETTER AND FOR LESS MONEY, I HAVE CREATED A MAILCHIMP CAMPAIGN TO INFORM THEM.

Read only? Yes.

But the readonly needs to be enforced on the service side. Like my personal agent has read only access to my Fastmail account via their MCP.

It can't send mail as me, but it can read, categorise and organise my mail.

If I were to give it the ability to send mail, it sure a fuck wouldn't be as me. It would have its own identity and account.

No, I very much am not. The only use of safe use of agents in that manner is if I make it its own newly created virtual user or human. It doesn't get my real world credentials or logins for anything.