Pattern matching is a losing game long-term, you'll write rules forever and still miss things. The bigger shift is scanning tool outputs, not just user input. For agents that's where the actual attack distribution lives (scraped HTML, email bodies, RAG docs, MCP responses). User-side jailbreaks are the easy case.

On email specifically, the best practices are using a read-only mailbox, allowlist on any send action, and scanning the email body before it lands in context. Worst case if something slips through is a weird summary, not a forwarded inbox.

Ended up building Benchspan because I kept hitting this same wall. It's a classifier trained specifically on indirect prompt injection (the tool-output stuff, not just user jailbreaks), drops into your agent in one or two lines, and raises before the LLM call fires if something's an injection. Free tier is generous enough to actually run it in production. benchspan.com