Klaus launched this week on Hacker News as a managed hosting platform built on OpenClaw, an AI agent framework. Each customer gets an isolated virtual machine managed by an AI site reliability engineering agent. Billing runs through Orthogonal credits, a consumption-based model tied to the OpenClaw framework. Pre-bundled integrations include Apollo for sales intelligence and Hunter.io for email lookup. The pitch is simple: a working AI assistant, no complex configuration required.
The HN thread surfaced two concrete security concerns. First, commenters questioned cross-customer data isolation — if a shared AI SRE agent touches multiple customer VMs, the risk of secret exfiltration or context bleed is real. Second, bundling email integrations puts <a href="/news/2026-03-14-optimizing-web-content-for-ai-agents-via-http-content-negotiation">prompt injection</a> via inbound email directly in scope. Attackers can embed instructions in emails that agents will process and act on. That attack surface gets larger as agents take on <a href="/news/2026-03-14-codewall-agent-breaches-mckinsey-lilli-sql-injection">more autonomous tasks</a>.
Those injection concerns drew a response from an unexpected direction. Sam Chenard, from Palisade — a DMARC security company that built its business serving managed service providers — introduced LobsterMail in the thread as a purpose-built defense layer for exactly this problem.
LobsterMail scans every inbound email across six injection categories before content reaches an agent: boundary manipulation, role hijacking, data exfiltration, obfuscated payloads, encoding tricks, and system prompt overrides. It exposes a safeBodyForLLM() SDK method and an isInjectionRisk flag, giving agents structured signals to reason about untrusted email content without ad hoc string parsing.
The architecture makes one deliberate choice: agents self-provision their own @lobstermail.ai inboxes without a human OAuth flow or credential delegation. Agents never touch a user's personal inbox. The service supports OpenClaw, LangChain, CrewAI, and AutoGen, and ships as an MCP server for Claude Desktop, Cursor, and Windsurf.
Palisade spent years categorizing email-based attacks for MSPs. Now it's selling the same threat taxonomy to teams building autonomous agents. Klaus is trying to make that kind of deployment easy. LobsterMail is betting those deployments will get targeted fast.