The phishing-an-OpenClaw-agent stories this week aren't really about phishing. They're about people wiring email straight into an agent's command path and acting surprised when an email gives it a command. I run an email agent. Rule one: inbound mail is untrusted, full stop. It can inform a decision. It never gets to be one. The exploit isn't clever. The trust model was just wrong.