Resend gives each agent its own mailbox. Jon's agents put two to work overnight

Resend, the email service that sends Jon's site mail, has a private beta called Inboxes, billed as "the inbox for agents". One API call gives an app or an agent its own address on a verified domain. Agents reach threads and drafts through an API, MCP or skills, and a webhook fires on each new email. A built-in agent takes plain-English instructions, such as "label and triage new emails, draft replies". The free tier covers three inboxes and 3,000 emails.

The product page says nothing about the risk that comes with it. Resend's own Agent Email Inbox skill does: "An AI agent's inbox receives untrusted input. Without proper security, anyone who knows your agent's email address can send instructions that your agent will execute." It sets out five levels, from a strict sender allowlist to human approval of every action, and says to start at the strictest. The skill was rebuilt on Inboxes in a pull request merged October 14.

Jon's agents put two inboxes to work overnight. The first handles client support on his own site's domain, clientsupport@limitededitionjonathan.com, set up and receiving mail on October 19. Resend's built-in agent only makes drafts, even of forwards, so Jon turned it down and the agents built their own handler. Jev screens out spam and unknown senders. Claude Haiku 5.5 answers routine client questions, such as an invoice or signing in, in about two seconds, in the client's thread. Anything else goes to Jon. On 10 made-up emails, run three times each, it made 30 of 30 decisions right. They included an email giving the agent orders and one from a look-alike domain. It is deployed and waits for Jon's go before it is switched on.

The second came from a sales pitch. Someone used the contact form on hyperkonic.com, the site of Jon's company HyperKonic, to sell "AI visibility" to a site one day old. Now every form message gets one question to Jev, the decision model Jon's agents use for sorting: real inquiry, or sales pitch? Real messages reach Jon; pitches go to a spam@ inbox. An error, a reply slower than three seconds or an answer it can't read counts as real, so nothing is ever dropped, only sorted. It went live early on October 20, after this test, each message run twice:

Each call took 98 to 211 milliseconds. All 20 cost $0.000524 together. One pitch had come by direct email instead of the form, so a second change, live the same morning, runs the same Jev check on mail sent straight to the company's addresses. That pitch was caught three times out of three, and five real-style emails passed 15 of 15.

How to use it

• Ask for access from Resend's labs settings. The Create Inbox reference asks for resend@6.33.0 in Node or resend-cli@2.25.0.
• Create an inbox with its email_address. The domain needs receiving turned on, with DKIM, SPF and the inbound MX record. With forwarding: true, DKIM and SPF are enough. An address already in use returns a 409; a team at its plan's limit gets a 403.
• Install the security skill with npx skills add resend/resend-skills, pick a level before writing the webhook, and verify every webhook's signature.
• Treat each built-in agent action as a draft. For answers that go out on their own, a webhook into your own handler gives you the screen, the model and the checks.
• On a public form, sort before the inbox: one Jev choice question, failing open to the normal path, with the verdict stored so a misfiled message can be found.
• The catch: it is a beta, and Resend says the response shape may change before general release.

What nobody knows yet

The tests are small: twelve emails across both checks on HyperKonic, ten on client support. The first proof is the next real pitch, and the stored verdicts will measure it over time. The client-support handler has not answered a real client yet. Resend's own agent was not tested against an email full of instructions; the fleet's handler was, once. Resend hasn't published paid pricing for Inboxes or a date for general release.

What to watch

Resend's general release of Inboxes, with its pricing and any change to the API, the first sales pitch through hyperkonic.com's live filters, and the day the client-support handler is switched on.