How can an AI agent avoid using an old verification code?
Match the message to the current account and attempt, then use the newest matching code while the service still accepts it.
An inbox can hold several similar emails. The first six digits the agent finds may belong to an earlier attempt.
A discussion of agent email identity describes crossed codes and old magic links as everyday problems when workflows share mail.
A small test you can run
- Send two sample messages to a test inbox, each with a different dummy code and timestamp.
- Record the start time of a pretend verification attempt, and filter for new messages addressed to the right inbox.
- Match the expected service and the purpose of the message. Check where any link goes before opening it.
- Confirm the workflow picks the later matching message, ignores unrelated mail, and stops after a timeout if no match arrives.
- Keep code values out of saved logs. If the real service rejects a code, check its instructions and whether a newer attempt has cancelled the earlier one.
Do not assume every service cancels old codes the same way. The service decides how long a code lasts and whether it is accepted.
ActAs gives each agent its own inbox, so one agent's codes do not land among another's, and a wait can be limited to mail that arrives after a time you set. See the guide to 2FA codes.