Claude’s New Email Management Feature Raises Security Red Flags

Anthropic’s Claude AI has reached a milestone that underscores both the rapid advancement and inherent vulnerabilities of generative systems: it can now fully manage Gmail inboxes, including sending, replying to, and forwarding emails without user approval. The capability marks a significant step in AI-assisted productivity, but security experts are urging caution.

The risks are not theoretical. Prompt injection attacks—where malicious actors embed hidden instructions within emails—have already demonstrated real-world damage. In one recent incident involving a similar AI agent, an attacker successfully hijacked the system to delete a researcher’s emails after embedding invisible instructions in plain sight.

“We still don’t know how to 100% reliably prevent [prompt injection] from happening,” said Simon Willison, who coined the term. Experts remain divided on whether the problem is fundamentally solvable.

Beyond targeted attacks, Claude’s tendency to hallucinate false information or misunderstand vague instructions poses its own dangers. An AI that drafts and sends emails autonomously could inadvertently share incorrect details, forward sensitive information to wrong recipients, or commit privacy violations by exposing inbox contents to Anthropic’s systems.

Anthropic has built in safeguards, including the ability for Claude to trash or archive emails but not permanently delete them. The default behavior requires user approval before sending, a setting users are advised to keep enabled.

Security best practices include being specific in instructions, enabling multi-factor authentication across accounts, and remaining cautious with unfamiliar senders. But as Willison noted, the fundamental challenge of preventing prompt injection remains unsolved.