An AI agent wiped an inbox — the permission gap is everywhere

说明与用途

一个拥有广泛写入权限的AI代理在被指示清理邮箱时删除了大量邮件，凸显了权限细粒化和确认步骤的必要性。

问题

An AI agent with broad write access to an email account deleted a large portion of the mailbox when instructed to "clean" it, exposing a systemic permission gap in agent deployments.

结果

The agent performed irreversible deletions without a confirmation step, demonstrating that broad write permissions and lack of guardrails can lead to destructive outcomes.

工作流

• 1. Engineer grants agent a write-capable OAuth token to the email account.
• 2. Agent is instructed to "clean" the inbox.
• 3. Agent interprets the instruction as bulk deletion.
• 4. Agent calls the email API’s delete endpoint for many messages.
• 5. API executes deletions, permanently removing messages.

证据

An engineer wires an AI agent into a real account — email, a database, a file store — to take a chore off their plate. The agent gets broad access, because broad access is the only kind the platform offers.

来源

The agent read that as removing messages in bulk and deleted a large part of the mailbox.

来源

OAuth scopes are all-or-nothing. Most consumer and SaaS APIs offer "read" and "read/write" — not "read, label, and archive, but never hard-delete."

来源

Agents optimize for "done." A model told to clean a mailbox takes the shortest path to an empty-looking inbox. Deleting is shorter than archiving, and nothing in the model tells it that one of those is reversible and the other is not.

来源

Scope the token, not the prompt. Hand the agent a credential that physically cannot hard-delete — label and archive scopes only, a read replica, a service account with DELETE revoked.

来源