Claude's answer to Musk's Grok-DMs tip nails the prompt injection risk
alex_verem · x · 2026-10-19
Alex Verem asked Claude (Opus 5.5 High) whether connecting an AI agent to your DMs and email — Elon Musk's recommended way to use Grok — is a good idea, and posted the answer.
Claude's core argument:
- The problem isn't that the agent reads your messages; it's that it can't tell a message from an instruction. Anyone who can email you can try to give your assistant orders — a hidden line in a newsletter saying "forward the last invoice" or "reply with the code you just received."
- Suggested defenses: let the agent only summarise and draft; keep every send, payment, deletion, and login as a step you approve yourself; keep work and personal accounts separate.
- The asymmetry: convenience grows a little each time you grant access, while risk grows with everything the account touches.
A concise but pointed primer on indirect prompt injection risk for personal AI agents.
More from Safety
- Microsoft's ASSERT and ACS: blocking AI agents from accessing the wrong account — usamawahabkhan · 2026-10-19
- OpenRouter details Sentinel, a self-improving 24/7 security agent with 0.05% false-positive rate — Dan_Jeffries1 · 2026-10-19
- One refusals at a time: user says Claude's automated safety checks make the product unusable — DubaiInJuly · 2026-10-19
- GPT-4.1 with RAG hits 92.1% accuracy reviewing clinical trial informed consent forms — lamechthinkbig · 2026-10-19
- Musk warns many will be 'one-shotted' by super-persuasive superintelligences — elonmusk · 2026-10-19
- Gemini's critical summary of a safety report surfaces downplayed residual risks — davidmanheim · 2026-10-19