When an agent reads your email, anyone who can send you a message can put text in front of it. A hidden instruction can change what the agent tells you, or, if the agent can send or delete mail, make it act for the attacker.
Simon Willison describes the risk as three things together: access to private data, exposure to untrusted content, and a way to send data out. An email assistant with send rights has all three. In a demonstration reported by BleepingComputer, white text at zero font size in an email made Gemini's summary show a fake password warning.
Give inbox agents read access only and block send, forward and delete tools. Tell the agent to treat every email as untrusted and never follow instructions inside one. Ask it not to copy phone numbers or links into summaries unless you ask. Act on any security alert, bill or payment request only through the official site or app that you open yourself. If the agent must draft replies, keep each one behind your approval.
Researcher Marco Figueroa hid an instruction in an email with invisible text. When the user asked Gemini for a summary, it showed a fake password warning with a phone number. Google said it had seen no evidence of real attacks of this kind.
Willison explains that an assistant that reads your email can be told by an attacker's email to forward password reset messages and then delete them, because it holds private data, reads untrusted text and can send messages.
The author notes that Cowork is open to prompt injection when it reads files and may expose sensitive data if tricked, and warns that many approval prompts lead to approval fatigue.