Your AI reads your email. Anyone can write to you. Is that safe?

How prompt injection works with email

An assistant does not separate your request from the content it reads: an email, a PDF attachment or a chat message all arrive as text. A sender can write a line aimed at the AI rather than at you, sometimes hidden in white text or in an attachment.

The risk depends on the tools the assistant has. If it can send email, a hidden instruction can make it send your data to someone else. If it can only read and write drafts, the same instruction ends up, at worst, in a draft you will see before anything leaves.

What Fezola does about it

• No send tool: on Fezola's servers, direct sending is switched off, so the assistant is not even offered a tool to send an email. An injected “send this to…” has nothing to call.
• Drafts only: replies and forwards are saved in the Drafts folder of the mailbox that received the email. You read the recipient and the content, then send from your own mail app.
• Google Chat and Telegram are read-only: the assistant cannot post in a space or a chat.
• Actions that change your mailbox (move, archive, trash, mark as spam, delete a draft) are labeled as destructive in the protocol, so Claude and ChatGPT can ask you to confirm them. Received messages are never permanently deleted: trash can be restored.
• Reading does not mark messages as read, and emails are read live from your mailbox, never stored by Fezola.
• Passwords and Google or Telegram tokens are encrypted (AES-256-GCM). The assistant never sees them, and connecting a source happens on Fezola, not in the conversation.

What no connector can do for you

Fezola limits what can happen through your mail, not everything your assistant can do. If the same conversation also has other tools, such as web browsing or another connector that can send messages, an instruction read in an email could try to use them. Keep an eye on what the assistant proposes, and review every draft before sending it.

Step by step

1. 1

   Connect only the sources you need

   The Free plan includes 2 sources. Start with the mailboxes you actually want to ask about; you can add more later.

2. 2

   Keep confirmations on in your assistant

   Let Claude or ChatGPT ask before tools that change your mailbox. Fezola marks those tools so the assistant knows which ones to confirm.

3. 3

   Review every draft before sending

   Check the recipient and the content of each draft in your mail app. A draft that addresses someone you do not know is the clearest sign of an injected instruction.

4. 4

   Check which assistants have access

   Ask your assistant to list the assistants connected to Fezola, or open the Connector page of your Fezola account. You can revoke access for any of them at any time.

Why Fezola

• No send tool: nothing leaves your mailbox without you.
• Drafts saved in the mailbox that received the email, with that address as the sender.
• Google Chat and Telegram connected in read-only mode.
• Messages are read live and never stored; tokens and passwords are encrypted.
• Works in Claude, ChatGPT, Perplexity and other MCP clients.

Questions

Sources

• OWASP Top 10 for LLM Applications: LLM01 Prompt Injection
• Model Context Protocol: tool annotations

Keep reading