Claude can manage your email inbox, but risks remain

Anthropic has expanded its Claude AI assistant to manage users' Gmail accounts, allowing it to read, compose, send and forward emails on request. Settings can even let Claude act without requiring approval for each individual action, though this introduces notable risks.

The most serious threat is prompt injection, a technique where an attacker embeds hidden text — such as white-on-white or zero-size font — inside an email. This text is invisible to the human recipient but can be read and followed by Claude as an instruction. Through this method, hackers could potentially monitor a victim's inbox or extract sensitive data, including verification codes used to compromise other accounts. This is not a theoretical threat; such attacks have already occurred in practice.

A second risk comes from the AI's own fallibility. Claude can hallucinate false information or misinterpret a user's request, meaning an email sent on someone's behalf could contain errors that the recipient notices before the sender does. There are also broader privacy concerns tied to giving Anthropic and its AI access to the full contents of an inbox.

To reduce these risks, it is recommended to keep the default setting requiring approval before any email is sent. Users are also advised to give Claude highly specific instructions to minimize the chance of misunderstanding. Prompt injection cannot currently be fully prevented — a point acknowledged by Simon Willison, who coined the term, noting that the industry still lacks a reliable solution. Extra caution with unfamiliar senders and enabling multi-factor authentication on other accounts can help limit exposure, though some risk remains. Notably, Claude cannot permanently delete emails; it can only trash or archive them.