The era of handing over email accounts wholesale to AI has arrived. With a single click, AI can read, write, and send emails. Convenience has come with fear as well.
On the 18th of last month, Anthropic enabled Claude to send, reply to, and forward emails in Gmail. The default setting requires user approval each time, but users can change it to send immediately without approval if they wish.
OpenAI’s GPT-6 Astra, unveiled on the 3rd, went a step further. It fills spreadsheets, formats documents, and navigates web pages. OpenAI co-founder Greg Brockman said, “It would not be an exaggeration to call it the first model of the AGI era.”
AI has entered an era in which it is entrusted with entire email accounts. With a single click, AI reads, writes, and sends mail. That convenience has also brought fear.
Anthropic enabled Claude on the 18th of last month to send, reply to, and forward emails in Gmail. The default setting requires user approval every time, but it can be changed so that emails are sent immediately without approval.
OpenAI’s GPT-6 Astra, unveiled on the 3rd, went a step further. It fills spreadsheets, formats them, and moves around web pages. OpenAI co-founder Greg Brockman said, “It is no exaggeration to call it the first model of the AGI era.”
◆ How far have agents come?
An agent is different from a chatbot that simply answers questions. When given a goal, it independently selects tools and carries out multiple steps. It can handle email organization, scheduling, research, and file management without human intervention.
The open-source camp is moving especially fast. OpenClaw is a personal agent created by PSPDFKit founder Peter Steinberger. It can be connected to messengers such as Slack, Discord, iMessage, and WhatsApp, and can read and write files, run scripts, and control browsers. It gained 60,000 GitHub stars within 72 hours of release and, as of May, surpassed 370,000 stars to become the most starred project ever.
NVIDIA wrote that OpenClaw overtook React in just 60 days. Hermes, made by Nous Research, has 160,000 stars. Hermes emphasizes a learning function that creates and refines skills on its own based on work experience.
The problem is the level of access these systems require. They need access to email, messaging apps, files, and browsers to function properly. NVIDIA explains that such agents “move up only what a person needs to decide, and handle the rest on their own.” The broader the scope of autonomous handling, the greater the damage when something goes wrong.
◆ Even Meta’s safety chief got caught out
In February, Summer Yu, head of alignment at Meta’s Superintelligence Lab, assigned OpenClaw to organize her inbox. After testing it with a fake inbox, she connected it to her real account. OpenClaw began deleting emails older than a week.
Even when she told it “don’t do that,” “stop,” and “STOP OPENCLAW,” it would not listen. “I had to run to the Mac mini like I was defusing a bomb because I couldn’t stop it from my phone,” she wrote. The person researching AI safety was the one who suffered the incident. She later admitted it was a “rookie mistake.”
The incident happened without any attacker involved. Errors in which AI misunderstands instructions or hallucinates and sends nonexistent facts can happen at any time. If approval settings are turned off, the recipient reads the content before the user does.
If there is an attacker, the danger becomes greater. This is prompt injection. Instructions are hidden in an email body using white text or zero-point font size. Humans cannot see them, but the AI reading the message treats them as commands.
It is used to monitor inboxes or steal authentication codes for other accounts. Simon Willison, the British developer who coined the term, said, “We still do not know a way to stop this with 100% certainty.” Anthropic also warns of this risk when email sending permission is first enabled.
◆ So what is the solution?
Willison identified three conditions that make AI agents dangerous: access to personal data, exposure to untrusted content, and the ability to send information externally. An AI connected to an email account has all three at once. He said, “Avoiding the situation where those three are combined is the only safe path.” Based on that principle and advice from Engadget and NVIDIA, the countermeasures are as follows.
Do not turn off the approval function. Keep Anthropic’s default “confirm before sending” setting. Even if the AI is controlled, information will not be sent unless the user clicks the send button. Approval is the last line of defense against prompt injection.
Be specific with instructions. Vague requests such as “send the HR team the reason for my absence” can lead to misunderstandings. Specify who to send it to, what to say, and in what tone.
Minimize permissions. Start by connecting read-only access and have the AI summarize and categorize messages first. Enable sending only when necessary. Among the three conditions Willison described, turning off the external transmission capability is the easiest.
If you are using an open-source agent, NVIDIA recommends running it in a sandbox with permissions narrowly defined. Testing first with a fake inbox, as Summer Yu did, is another option. However, she suffered an incident in her real account after the test passed. Passing a test does not guarantee safety.
Separate authentication codes from email. Switch two-factor authentication for banks, portals, and work accounts from email to an authenticator app or security key. If AI reads your mail but the code is not there, account takeover will not follow.
Do not leave unfamiliar sender emails to AI. Read messages from unknown senders or messages with attachments yourself before letting AI handle them. Prompt injection can happen with just one email.
The era in which AI does everything for us is coming. But in that era, safety comes not from AI, but from the scope of permissions set by the user. A single approval button, a single permission setting, defines that boundary.