Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Agent.email – sign up via curl, claim with a human OTP

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#101

Post by dgellow »

sunir wrote: post #46
dgellow wrote: post #32

Earlier quoted context omitted.

But how does that block a human from running an agent that is using their identity?

Think about it from an information theory point of view. You need to attach a digital transaction to human body. Since a human body isn’t digital you need a gateway that you can trust to vouch for that human body being present. Either you use biometrics, like liveness testing or face id or fingerprint testing, or social validation like decentralized web of trust or private moderation (account controls) or state metho…

What I mean is that once you have a token that represents your identity, you can pass it to your agent. As you said, humans aren’t digital, so we need to delegate the trust to a digital marker (auth token, cryptographic signature, etc). But once digitalized there is no way that I know of to block an agent from using that marker. And I don’t mean the agent stealing it. I mean the human running an agent that impersonates them deliberately

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#102

Post by xigoi »

TurdF3rguson wrote: post #72
Aurornis wrote: post #52

> We give AI agents their own email inboxes. An inbox to receive mail seems good and valuable. But I'm seeing that your service is also for sending e-mail. Having a domain oriented toward AI e-mail sending feels like a fast path straight to spam block lists. However good your intentions are, this will be used for AI spam. People hate AI spam. They will press the report spam button.

> An inbox to receive mail seems good and valuable. The only receiving mail applications that come to mind are bots registering for accounts. The point of verifying email is to prove you're not a bot.

> The point of verifying email is to prove you're not a bot.

I thougt it was primarily to verify that the address is actually yours, so they don’t unknowingly spam someone else and can reach you with important information such as pricing changes.

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#103

Post by Lalabadie »

Alex_toani wrote: post #100
mike-cardwell wrote: post #41

Earlier quoted context omitted.

Re "sent via AgentMail" - that's good to hear, but I hope it's not the entire planned text, as "AgentMail" will mean nothing to most people that receive an email from your service. It wont indicate that the email was composed by an AI rather than a person, which is the information that needs to get across.

What if a people send email via te agent and using agent mail? writing by the agent but aproval by human.

There are OS-native options everywhere to spawn an email client window that's filled out and ready to send from your address, so that couldn't possibly be a differentiator for them

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#104

Post by bfeist »

echoangle wrote: post #64
adisingh13 wrote: post #62

Earlier quoted context omitted.

yep we're going to have a footer linked to our website, which should allow people to see that we are an email service for agents. thanks!

Can you not just make the text more descriptive? „Sent by a generative AI model“ or something? Nobody is going to click a link in a spam email.

They’re literally using an LLM to write the email.They could make the disclaimer text detailed and descriptive per email sent. So the use case they’re citing here that “well what if it’s just an email that was forwarded by the bot” doesn’t apply because you could add a different disclaimer message at the bottom of that email vs the spam example above.

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#105

Post by bfeist »

sanjayparekh wrote: post #34
mike-cardwell wrote: post #30

I received this email the other day: From: Kushal Date: Mon, 18 May 2026 05:03:11 +0000 Saw your question on the Agent Vault thread about websocket-frame auth (Home Assistant) and the worry about the model reflecting the bearer token back into its own context. chrome-relay's answer is structurally different: the credential never enters the agent's context because the agent never touches it — the HA session lives in y…

See my comment in this thread - I got an email from "someone" (an AI clearly) that signed up for my service (togetherletters.com) from the same domain (agentmail.to) after we had launched on ProductHunt. I looked up the address and that email was never used for a signup and it was just a way to then pitch their product (second email, not the first one it sent). I hate this so much and this is going to now make email…

I agree with what you’re saying, but I think that email was one of the first parts the web to become terrible. This happened a long time ago, we’re just used to it.

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#106

Post by skinfaxi »

replwoacause wrote: post #84
echoangle wrote: post #64

Earlier quoted context omitted.

Can you not just make the text more descriptive? „Sent by a generative AI model“ or something? Nobody is going to click a link in a spam email.

He's obviously trying to avoid having to do this, so linking out to the website is the "hey look we're doing the right thing" when really they aren't. Chances are more people would identify the service as something to block or report for spam if the text were more descriptive, so he's counting on people not clicking the link in the footer but at least he can claim it's there, even if it's ineffectual.

This service will be marked as spam anyway, it's only a matter of time.

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#107

Post by [deleted] »

dgellow wrote: post #36
mike-cardwell wrote: post #30

I received this email the other day: From: Kushal Date: Mon, 18 May 2026 05:03:11 +0000 Saw your question on the Agent Vault thread about websocket-frame auth (Home Assistant) and the worry about the model reflecting the bearer token back into its own context. chrome-relay's answer is structurally different: the credential never enters the agent's context because the agent never touches it — the HA session lives in y…

You might want to check if your local laws protect against unsolicited emails. In Germany we have §7 UWG which would make that email likely illegal. The List-Unsubscribe header makes it clear it is marketing, automated outreach and not personal. In the UK there is this: https://ico.org.uk/for-organisations/direct-marketing-and-pr...

[deleted]

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#109

Post by sunir »

dgellow wrote: post #101
sunir wrote: post #46

Earlier quoted context omitted.

Think about it from an information theory point of view. You need to attach a digital transaction to human body. Since a human body isn’t digital you need a gateway that you can trust to vouch for that human body being present. Either you use biometrics, like liveness testing or face id or fingerprint testing, or social validation like decentralized web of trust or private moderation (account controls) or state metho…

What I mean is that once you have a token that represents your identity, you can pass it to your agent. As you said, humans aren’t digital, so we need to delegate the trust to a digital marker (auth token, cryptographic signature, etc). But once digitalized there is no way that I know of to block an agent from using that marker. And I don’t mean the agent stealing it. I mean the human running an agent that impersonat…

Exactly. There is only an arms race, which is escalating costs. Eventually it breaks and we use social means to manage it, surrender the digital space, or accept the artificial nature of the digital realm.

Re: Show HN: Agent.email – sign up via curl, claim with a human OTP

#110

Post by DigDev »

samas10 wrote: post #3

It's interesting, A2A communication has begun but human trust isn't there. I think the biggest tell tale sign will be the acceptance of fully agentic workflows with no human intervention. Until then, restricted-until-claimed seems like the only viable method to ensure trust of all users.

[flagged]
Post reply on HN