Integrations
Security testing for AI agents with Gmail access
An AI agent connected to Gmail acts through OAuth scopes such as reading mail, sending mail and changing settings. Every inbound email is untrusted text the agent reads. Google advises choosing the most narrowly focused scope possible. We test whether a crafted email can make your agent send, forward or reveal mail it should not.
Gmail is named here as a surface we test. Names and logos belong to their owners; no customer relationship, partnership or endorsement is implied.
What can an agent do through the Gmail API?
Google's Gmail API scopes page lists what each scope allows. gmail.readonly lets an app view email messages and settings. gmail.send lets it send email on the user's behalf. gmail.compose manages drafts and sends email, and gmail.modify reads, composes and sends email. gmail.settings.basic allows seeing, editing, creating or changing email settings and filters. The full https://mail.google.com/ scope adds permanent deletion that bypasses the trash.
The sending call itself is users.messages.send, and filters are created with users.settings.filters.create. In an agent, the recipients, body and filter criteria for those calls can all come from the model.
How do Gmail actions get abused?
| Action | Abuse path | Class |
|---|---|---|
| Read messages | An inbound email contains instructions the agent follows when it summarizes or triages the inbox. | Prompt injection |
| Send or reply | The agent sends other messages, attachments or a summary of the inbox to an outside address. | Data exfiltration |
| Create filters or change settings | A filter quietly forwards, archives or labels future mail so the owner does not see it. | Unsafe actions |
| Restricted scope where a narrower one would do | An agent that only drafts replies holds a scope that can read and send everything. | Privilege escalation |
Email is an unusually open channel. Anyone who knows the address can put text in front of the agent, without logging in to anything you control.
Illustrative trace
Illustrative example, not a real customer finding.
What least-privilege controls does Google document?
Google's scopes guidance says to choose the most narrowly focused scope possible, avoid requesting scopes the app does not require, and use non-sensitive scopes where they cover the feature. It classifies gmail.send as sensitive and gmail.readonly, gmail.compose, gmail.modify, gmail.settings.basic and the full mail scope as restricted, which brings additional verification requirements for public apps. It also notes that the full mail scope is only needed for immediate permanent deletion and that every other action is possible with less permissive scopes.
Scopes decide what is possible. Your own checks decide what is allowed: which recipients the agent may send to, whether it may send without a person confirming, and whether it may touch settings at all.
What do we test?
In an Agent Action Pentest we list the scopes your agent's OAuth grant holds and compare them with its task. We send crafted emails into a test mailbox the agent reads and check whether it sends, forwards, replies with other mail, creates filters or deletes messages. Testing uses mailboxes you create for the engagement, never a production inbox. Related risks: prompt injection, indirect prompt injection, excessive agency and sensitive information disclosure. Email agents built on the OpenAI Agents SDK or LangChain call Gmail through tools you write, so the recipient and confirmation checks belong there.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Do you need access to a real mailbox?
No. We use test mailboxes you create, with the same OAuth client and scopes your agent uses.
Which Gmail scope should an email agent use?
The narrowest one that covers its task, per Google's guidance. A drafting agent rarely needs send or settings scopes.
Do you test Gmail itself?
No. We test your agent and the code around its Gmail calls.
Related pages
- 02Indirect prompt injection in AI agentsHidden instructions in emails, pages, files or tool results steer an agent that reads them.
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 04Sensitive information disclosure through agent actionsCustomer data, secrets or system prompts leave through output, links or tool calls.
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- Security testing for AI agents in SlackChannel history, message posting and link unfurling for agents installed in Slack.
- Security testing for OpenAI Agents SDK appsFunction tools, handoffs, guardrails and MCP servers in the OpenAI Agents SDK.
- Security testing for LangChain and LangGraph agentsTools, permissions and human-in-the-loop interrupts in LangChain and LangGraph.
Sources
Last reviewed: