Claude gains Gmail send powers, with prompt-injection risks

Claude can now send, reply to and forward Gmail messages on a user's behalf, and Engadget walks through the attack surface that opens up the moment an LLM is wired into a live inbox.

The concrete danger is prompt injection. An attacker sends a message containing hidden text, white on white or set to zero font size, that Claude reads but the user does not. The reporting warns that malicious actors could "stealthily give Claude instructions by sending an email" with concealed content to monitor an account or pull verification codes for other services. The piece also flags that Claude "may hallucinate false information into an email and send it before you catch it," and notes that turning the feature on means trusting Anthropic with the contents of the inbox.

Simon Willison, who popularized the term prompt injection, is quoted saying "we still don't know how to 100% reliably prevent this from happening." Two AI researchers we follow shared the piece the day it went up. The practical defense Engadget lands on is unglamorous: leave the default "ask before sending" approval mode on, because switching it off is what actually exposes the account.