Claude can now run your Gmail inbox. It can read, draft, reply, forward, archive, trash, and, if you flip the setting, send emails without asking you first. Engadget's writeup of the feature from September 6 spends most of its length on the risks, and it's right to do so, because your inbox is the one account that unlocks every other account you own.
Let's lay out the risks plainly.
Your inbox is the master key
Think about what actually arrives in your email. The Password resets, the Two-factor authentication codes. "Confirm this login." Bank statements. Contracts. Whoever can read and have access to your email can, with a little patience, become you almost everywhere.
So the question isn't whether an AI can sort newsletters. It's whether you want a system that can be talked into things in control of the account that resets all your passwords.
And the issue is that these systems can be talked into things. The attack is called an prompt injection. It's the AI version of social engineering, where basically instead of a customer service representative hand over the sensitive information, it's the AI. An attacker sends you a message with instructions hidden in it, an HTML comment, whatever. You never see it there and then you ask Claude to summarize your inbox. Claude reads the hidden text along with everything else, and gets tricked into something it's supposed to do.
There's no malware, no link you have to click. The payload is just a sentence addressed to the AI instead of to you, and it arrives through something that anyone on earth can write to.
It has been demonstrated, not theorized
Security firm Zenity showed this against Claude in Chrome and ChatGPT Atlas in August. The delivery, per SecurityWeek: "a victim receives a malicious email containing invisible prompt structures." The trigger was simply asking Claude to summarize recent emails. The result was a script that "queries Gmail's Atom feed, extracts message IDs, parses full email bodies, and silently exfiltrates inbox contents to the attacker server." A variant silently shared every file in the victim's Google Drive with an account the attacker controlled.
Anthropic received the reports in December and January and classified them as informative, no patch. OpenAI's position on Atlas was that "there is no easy patch because the exploit relies on the intentional core capability of an agentic browser." Neither was fixed as of August.
An agent whose job is to read untrusted text and then act on your behalf has, by design, a channel through which untrusted text can shape its actions. A recent paper titled "AI Agents May Always Fall for Prompt Injections" argues it can't be fully closed: "an adversary can always construct a context under which a blocked flow appears legitimate, or a defender who tightens norms will block genuinely legitimate flows." Simon Willison, who has tracked this problem longer than anyone, put it to Engadget more simply: "we still don't know how to 100% reliably prevent this from happening."
And the attacker doesn't even need to be clever. Engadget names the concrete version: hidden text telling Claude to watch the inbox and pull out verification codes. That's account takeover, delivered by email, executed by your own assistant.
The non-attack failure is real too
Set aside attackers entirely and it can still go wrong on its own. Engadget notes the assistant might send emails with hallucinated details or a misunderstood request before you review them. And it cites an incident where OpenClaw "ignored instructions and deleted" the emails of a Meta AI safety researcher. No adversary needed, just a model that decided a cleanup meant something broader than intended, in an account where deletion is hard to reverse.
I've written about the same class of attack against coding agents, and the difference here is worth stating. If an injected README makes Claude Code run a bad command, the blast radius is a repo, and I have backups. If an injected email makes an assistant forward my password resets, the blast radius is my life, and the mail is already gone.
What I'd actually do
Anthropic's own advice is keep approval on, meaning Claude drafts and you're the one that has to send all emails yourself. I'd never turn it off for a primary account, no matter how tedious the confirmations get, because the confirmation is the only human step between sending away your secrets.
Beyond that: don't point it at the inbox where your password resets land. If you want AI triage, give it a secondary email address that receives newsletters and receipts, and keep the account that owns your identity untouched. Treat "summarize my inbox" as an action with consequences rather than a read-only request, because in these systems reading is where the instructions get in.
I use Claude for a lot, and I'd let it read a scoped, disposable inbox tomorrow. The account that can reset my bank login, it doesn't have access to, and I'd say the same about ChatGPT or anything else. The convenience is real. It's just that the thing it's asking to be handed is the key to everything else, and the people who build these systems are telling you, in their own words, that they can't fully secure it yet.
Sources
Engadget: Claude can help manage your email inbox, but there are some risks involved - The September 6, 2026 description of the Gmail feature including sending without approval when permitted, Anthropic's keep-approval-on guidance and setup warnings, the hidden-text verification-code attack example, the hallucinated-email risk, the OpenClaw deletion incident, and Simon Willison's quote.
SecurityWeek: Zero-click AI browser hacking, Claude and ChatGPT Atlas hijacked via emails, X posts - Zenity's August 2026 demonstrations, the invisible-prompt email delivery, the Gmail exfiltration chain and Google Drive sharing variant, and the vendor responses including Anthropic's informative classification and OpenAI's no-easy-patch statement.
Abdelnabi and Bagdasarian, AI Agents May Always Fall for Prompt Injections (arXiv) - The impossibility argument that an adversary can always construct a context in which a blocked flow appears legitimate.
