Ask Claude to tell HR you will be out on Thursday, with approval switched off, and it drafts and sends in one motion, so the first person to read that email is HR [5][15]. The pitch is inbox management, and the grant is standing authority to speak from your address [1]. Those are two different things to sign off on, and only one of them appears on the settings screen.
Engadget names four ways this goes wrong, and three of them need no attacker at all: hallucinated content in a message already sent, a misread instruction that forwards the wrong thread, and the plain fact that the inbox contents now sit with Anthropic [6][7][14]. The fourth is the one with a working proof. White-on-white or zero-point text in an incoming message is invisible to the reader and legible to the model, and Engadget reports it has been used to pull verification codes for accounts elsewhere [8][9][10]. Claude warns about this the first time you allow it to send, which is a candid thing for a feature to say about itself [3].
Every mitigation on offer runs back to the same switch. Writing more specific instructions narrows misinterpretation and does nothing about text you cannot see [13][8]. Multi-factor authentication elsewhere is recommended in the same article that notes those codes arrive in the mailbox the agent can read [13][9]. Simon Willison, who coined the term prompt injection, says we still do not know how to stop it reliably [11]. That leaves the approval prompt carrying the load by itself [2].
The hard line sits at permanent deletion: Claude can trash or archive, and it cannot destroy [4]. The blocked action keeps the message inside the account, while the permitted one puts a copy in someone else's [1].
For anyone rolling this out beyond themselves, the gap in the evidence matters more than the risk list. Engadget's account is written for one person with one mailbox, and it describes no admin-level control and no audit trail, so an organisation cannot tell from it who has approval switched off [16].
A workable test has two axes: what triggers the action, and where the result lands. Delegate without approval when you typed the request and the outcome stays in your account, which covers filing and drafting. Keep approval on for anything with an outside recipient. The quadrant to leave unattended is the one where arriving content triggers an outgoing message, because that is the exact path injection takes [8][9].
Who this is for: one operator whose mailbox is not the recovery address for anything expensive, and who would rather apologise for a clumsy email than write it. For a shared or role mailbox, that toggle is the outbound mail policy, and whoever flips it owns what leaves [1][2].
