A troll called "Mr. Focker" tried to make our AI sales agent blush. She wrote him a 3-page report for an email domain that doesn't exist.

We run a small company where six AI agents do the actual work. On our website there's a sales assistant called Flaminga (Claude + tool use, Flask on Railway). She answers questions and runs a 2-minute "AI Readiness Check" that ends in a personalised PDF report and a lead for us. Earlier this week a visitor calling himself "Mr. Focker" opened the chat. He clearly didn't want an assessment. He wanted to see if he could make the bot blush: "adult entertainment" business, one enquiry a week, 100% of them lost. Email: [[email protected]](mailto:[email protected]) The good news: she didn't take the bait. She ran the check like for any other business and produced a perfectly serious report. Readiness score 62, a "discreet enquiry-response agent" as the recommendation, 30/60/90-day roadmap. The bad news: our email check only validated the format. [[email protected]](mailto:[email protected]) is well-formed, so a full report plus a lead notification got generated for nobody. What we changed (same day): A gate in code (not in the prompt) before any tool call that creates something: typo domains → ask "did you mean gmail.com?", throwaway domains → ask for a real one, DNS check for MX (or A/AAAA as fallback) → no mail server, no report. Fail-open on purpose: only a definite NXDOMAIN blocks. Timeouts let the address through. A fake lead costs us cents. A real customer rejected because DNS sneezed costs us a customer. Then the fixes created their own bugs, which was the fun part: While recording screenshots we noticed: "I'm Max, I run a construction company" (in English!) got a German reply. The model guessed the language from the first name. Fix: put the counter-example literally into the prompt. When the gate rejected an address, Flaminga told visitors their "email bounced". Nothing had been sent. Our tool-result text ("NOT SENT … domain cannot receive email") was dramatic enough that the model invented a bounce. Rewording the tool result fixed it. We added a check that her first reply discloses she's an AI (EU AI Act). It passed on a reply that never said so, because the reply mentioned the "AI Readiness Report". The product name counted as the disclosure. Biggest lesson for me: tool-result text is a prompt too. Whatever you write there, the model will narrate it to the user. Curious how others handle this: do you gate tool calls in code, or do you trust the prompt for validation?