Author here. Sharing an architecture idea more than a product, because I think the threat model is under-discussed. There is a failure mode people call the lethal trifecta: an agent with access to private data, exposure to untrusted input, and the ability to send externally. Any two are recoverable. All three together means a hostile instruction hidden in an email can make the agent exfiltrate your data with nobody in the loop. You cannot remove the first two without gutting the assistant. I...