Anthropic's Claude AI assistant can now be given control of a user's Gmail inbox, capable of reading, drafting, replying to and forwarding emails, and in some configurations sending them without the user's prior approval. While this promises to save time for people drowning in email, the added autonomy brings real risks, since AI agents remain prone to errors and manipulation, as illustrated by a recent incident in which an AI agent wrongly deleted emails belonging to a Meta Superintelligence Lab researcher.

The article highlights three main dangers: Claude could hallucinate false information into an email before a user catches it, misinterpret instructions and send or forward the wrong message, or fall victim to "prompt injection," where an attacker hides invisible instructions inside an incoming email that hijack the AI into leaking data such as verification codes. Claude cannot permanently delete emails, only archive or trash them, and it warns users about injection risks when email-sending is first enabled. Security researcher Simon Willison, who coined the term "prompt injection," says there is currently no reliable way to prevent it entirely. The article advises keeping the "ask before sending" approval setting switched on and giving Claude precise, detailed instructions to reduce the chance of mistakes.