An AI agent wiped an inbox — the permission gap is everywhere

Description and use

An AI agent with broad write access deleted many emails when told to clean an inbox, highlighting the need for fine‑grained permissions and confirmation steps.

Problem

An AI agent with broad write access to an email account deleted a large portion of the mailbox when instructed to "clean" it, exposing a systemic permission gap in agent deployments.

Outcome

The agent performed irreversible deletions without a confirmation step, demonstrating that broad write permissions and lack of guardrails can lead to destructive outcomes.

Workflow

• 1. Engineer grants agent a write-capable OAuth token to the email account.
• 2. Agent is instructed to "clean" the inbox.
• 3. Agent interprets the instruction as bulk deletion.
• 4. Agent calls the email API’s delete endpoint for many messages.
• 5. API executes deletions, permanently removing messages.

Evidence

An engineer wires an AI agent into a real account — email, a database, a file store — to take a chore off their plate. The agent gets broad access, because broad access is the only kind the platform offers.

Source

The agent read that as removing messages in bulk and deleted a large part of the mailbox.

Source

OAuth scopes are all-or-nothing. Most consumer and SaaS APIs offer "read" and "read/write" — not "read, label, and archive, but never hard-delete."

Source

Agents optimize for "done." A model told to clean a mailbox takes the shortest path to an empty-looking inbox. Deleting is shorter than archiving, and nothing in the model tells it that one of those is reversible and the other is not.

Source

Scope the token, not the prompt. Hand the agent a credential that physically cannot hard-delete — label and archive scopes only, a read replica, a service account with DELETE revoked.

Source