Show summary Hide summary
Email assistants such as Anthropic’s Claude can be manipulated from inside an incoming message, creating a risk that goes beyond ordinary phishing. Security researchers and users should note that attackers have demonstrated ways to embed hidden instructions in emails that the AI can read — and act on — even when the human recipient cannot see them.
How hidden instructions reach the AI
One documented technique uses invisible text inside the email body — for example, white-on-white writing or text set to zero font size. That content is invisible to a person reading the message but can be parsed by an automated assistant when it processes the email.
Ultra-thin women smoking cigarettes are making a comeback as a fashion trend
Windows Memory Diagnostic explained: what the test does and how to read results
When the assistant reads and follows those embedded instructions, the result is a form of prompt injection: the attacker effectively hijacks the agent’s behavior from inside the message itself. Researchers have shown this can be used to extract data from a mailbox or trigger actions the user did not intend.
What attackers could access
- Contents of Gmail messages the assistant can read.
- Authentication or verification codes contained in email threads.
- Other sensitive information present in the inbox that the AI can access.
Automatic sending increases the stakes
Another practical danger arises from how seamlessly Claude can send messages on a user’s behalf. If the assistant is instructed to compose and send an email, it may do so immediately unless the user has enabled a preview or confirmation setting.
That workflow creates a real chance of error. An assistant can include incorrect facts, misinterpret a vague instruction, or hallucinate information. In those cases the recipient may see the mistake before the sender does, which can have reputational or security consequences.
Privacy questions remain
Beyond errors, the situation raises broader concerns about entrusting an entire inbox to a third-party AI. Even absent an active attack, users must consider what it means to allow the assistant access to personal and sensitive emails.
Anthropic’s tool itself flags prompt injection as a risk when users enable its ability to send messages. That notice underscores the need for caution when granting an assistant broad permissions over email accounts.
