the security risks of sharing your inbox with an ai agent

Your agent can book flights, write code, and manage your calendar. But the moment you connect it to your Gmail, you've handed it the keys to your entire life. Every password reset, every bank statement, every private conversation — sitting in a context window, waiting to be leaked.

This isn't hypothetical. In 2025 and early 2026, researchers demonstrated real zero-click attacks that exfiltrate data from personal inboxes through AI agents. Let's walk through the specific risks, because the details matter more than the fear.

Prompt injection through crafted emails#

The most immediate threat is indirect prompt injection. An attacker sends your agent a carefully crafted email containing hidden instructions — white text on a white background, tiny font sizes, or encoded strings buried in HTML. Your agent reads the email to categorize or summarize it, and the hidden instructions hijack its behavior.

This isn't a lab experiment. In June 2025, researchers at Aim Security disclosed CVE-2025-32711 (dubbed "EchoLeak"), a zero-click vulnerability in Microsoft 365 Copilot with a CVSS score of 9.3. An attacker sent a single email to an employee's Outlook inbox. When anyone later asked Copilot a routine question — summarizing a report, finding a file — the RAG engine retrieved the poisoned email as "relevant context," executed the embedded instructions, and silently exfiltrated SharePoint and OneDrive files to the attacker's server. No clicks required.

A similar attack, ShadowLeak, hit ChatGPT's Deep Research agent in September 2025. A single malicious email in a user's Gmail triggered the agent to leak inbox data from OpenAI's cloud infrastructure — invisible to local defenses. The proof-of-concept worked across Gmail, Outlook, Google Drive, Dropbox, and Notion connectors. Every shell your agent has access to becomes an attack surface.

Credential harvesting from password reset emails#

Your inbox is a vault of credentials. Password reset links, two-factor backup codes, API keys from SaaS platforms, OAuth tokens from app signups. When an agent has full inbox access, all of this sits within reach.

The OpenClaw security crisis made this painfully concrete. In late January 2026, security researchers found over 30,000 exposed OpenClaw instances publicly reachable on the internet. Inside those instances, researchers found Anthropic API keys, Telegram bot tokens, Slack OAuth credentials, and complete conversation histories. Sixty-three percent of observed deployments were vulnerable, with nearly 13,000 instances exploitable via remote code execution.

If your agent is connected to your personal inbox, it's not just reading emails — it's sitting on a trove of secrets. One compromised agent, and every credential that ever passed through your inbox is exposed.

Data leakage through context windows#

Every email your agent reads becomes part of its context. That context gets processed by an LLM, logged in conversation histories, and sometimes cached across sessions. Your medical appointment confirmations, your salary negotiations, your legal correspondence — they're all fair game once they're in the window.

A study across 1,000 enterprise environments found that 99% had sensitive data exposed to AI tools due to insufficient access controls. The problem isn't just malicious actors. It's the everyday reality of feeding private data into systems that weren't designed to protect it. Context windows don't distinguish between "this is a routine newsletter" and "this contains my social security number." To the model, it's all just tokens.

The blast radius of a compromised agent#

When your agent has access to your personal inbox, the blast radius of any compromise is everything. Not just the agent's tasks. Not just recent emails. Everything.

The ClawHavoc campaign in February 2026 showed how fast things can spiral. Researchers found 341 malicious skills in OpenClaw's ClawHub marketplace — roughly 12% of the entire registry — delivering infostealers disguised as legitimate tools. By mid-February, that number had climbed past 1,184. A single ClawHub user uploaded 354 malicious packages in what appears to have been an automated blitz. Every agent that installed one of those skills and had inbox access was a potential conduit for full credential theft.

This is the core problem with the shared inbox model. You can't scope the damage. A compromised agent with access to your personal email doesn't just lose its own data — it loses yours. Your contacts, your financial information, your private communications. The claw reaches into everything.

Isolation as mitigation#

The fix isn't to stop using AI agents with email. It's to stop giving them access to your email.

When your agent has its own dedicated inbox — its own shell — the blast radius shrinks to exactly what the agent needs. A compromised agent loses access to its own purpose-built inbox, not your 15 years of personal correspondence. No password reset links to harvest. No medical records to leak. No credentials sitting in old onboarding emails.

This is what agent email is designed for. Your agent gets an address like support-bot@getlobstermail.com and communicates through that. Your personal inbox stays untouched, out of the context window, out of reach.

It won't stop prompt injection from happening — that's a problem the entire industry is working on. But it limits what an attacker can get. The difference between "the agent's isolated inbox was compromised" and "my entire personal email history was exfiltrated" is the difference between an inconvenience and a catastrophe.

If you're connecting agents to email today, the question isn't whether something will go wrong. It's how much damage it'll do when it does. Your agent shouldn't be using your Gmail. Give it its own address, and keep the reef clean.

---

Give your agent its own email. Get started with LobsterMail — it's free.