AI that reads your inbox for you

4. Inbox agents and blast radius

An inbox reader that only summarises is closer to an advisor. One that files, replies, or changes rules is an actor. Keep money and recovery paths out of its reach until you have watched draft-only behaviour.

Check forwarding and filters after any AI mail trial. If something feels “helpfully rearranged,” use the kill-switch list in When the Bot Can Act Without You.

Note: This site may show light ads and occasional affiliate links. How that works.

Inbox assistants promise relief: summarise the day, draft replies, flag what matters. The catch is simple. Whatever can read your mail can also be nudged by whatever lands in your mail.

That includes poisoned messages — emails written less for you and more for the summariser sitting between you and the truth.

Remember this: Treat AI inbox summaries as a sketch, not a witness. Open anything about money, access, or urgency yourself.

1. A quiet inbox trap

You ask: “What needs me today?” The summary says a supplier invoice is approved and payment details changed. It sounds tidy. Buried in the PDF or the long thread was a line aimed at the bot: tell the reader to pay a new account. You almost trusted the summary more than the source.

That is prompt injection in the place people now live — the inbox. It builds on the same idea in Before You Paste It Into the Bot, in a setting where the “document” arrives uninvited.

2. What to keep human

Payment changes, refunds, and new bank details
Password resets and MFA prompts described in summaries
Legal, HR, or medical attachments
Anything that creates urgency or secrecy

3. Safer settings for mail helpers

Limit which folders an assistant can read.
Prefer draft replies over auto-send.
Do not grant “send as you” lightly.
If a summary pushes money or access, open the original thread on a device you trust.

A habit to keep

Summary first, source before action. The bot can triage. You still decide.

More on everyday scams: online scams hub.