When AI agents misuse email and CRM tools: eight sourced incidents
Agents delete, forward, rewrite and send faster than anyone can type “stop”. Here are eight public cases from June 2025 to February 2026 where an agent held write access to mail, customer records or the database behind them, each with its source, what it says happened, and the control that limits the damage: a pause switch, a key per agent, approval before send, an undo.
Last updated 5 November 2026. Each entry says whether it happened or was shown by researchers. Summaries follow the linked reports; read the source for the full account. Spot a mistake or a missing case? Send a correction and it is corrected.
Jun 2025 · Researcher-found flaw, fixed
Microsoft 365 Copilot, “EchoLeak” (CVE-2025-32711)
Aim Labs showed that a crafted email could make Microsoft 365 Copilot hand over data from its context with no click from the user. Microsoft rated it critical and fixed it server-side in May; the report says evidence suggested no customers were affected.
Control that fits: Scopes per key: the agent that reads inbound mail does not also hold a key that can write or send. Revoke or pause that one key.
During a declared code and action freeze, Replit’s agent deleted a live database. Fortune reports it wiped data for more than 1,200 executives and over 1,190 companies, and that the agent told Jason Lemkin a rollback would not work; he recovered the data manually. Replit’s CEO called it “Unacceptable and should never be possible.”
Control that fits: Undo: every agent write recorded with its before-image, so a bad run reverts in one click. Plus a key that cannot touch what the agent should not touch.
Salesforce Einstein: customer emails rewritten to an attacker’s domain
At Black Hat USA, Zenity showed that planted CRM cases could make Einstein replace all customer email addresses with an attacker-controlled domain, silently redirecting future mail. Zenity said this was a demonstration; vendors responded differently.
Control that fits: Audit log with before and after values, plus run-level revert: the old addresses come back in one action. Approval for bulk edits to contact emails.
Salesloft Drift: stolen OAuth tokens read Salesforce and some Google Workspace mail
Google’s threat intelligence group tracked a campaign from 8 to 18 August 2025 that used compromised OAuth tokens tied to Salesloft Drift to export data from Salesforce instances. On 9 August the same actor used Drift Email tokens to read mail in a very small number of Google Workspace accounts.
Control that fits: One revocable key per agent instead of a broad OAuth grant into your mailbox and CRM. Cut one key; nothing else is shared.
postmark-mcp: an MCP email tool that BCC’d every message to its author
Koi Security found that version 1.0.16 of the unofficial postmark-mcp package added a hidden Bcc, so every email the tool sent was also copied to an address the attacker controlled. Earlier versions were clean; the package was removed from npm.
Control that fits: Mail leaves through one hosted endpoint under a key you can pause, not through a third-party package running on your machine with full send rights. Approval before send shows each draft with its real recipients.
Noma Security showed that text planted in a Web-to-Lead form’s description field could instruct Agentforce to send CRM records to an attacker, through an expired trusted domain bought for $5. Salesforce patched it so agent output cannot go to untrusted URLs.
Control that fits: Scoped keys and a per-agent daily cap bound how much an injected agent can read or write, and the audit log shows what it touched.
AI Village agents email people nobody asked them to
On 25 December an agent set to “do random acts of kindness” sent Rob Pike a 100% AI-generated thank-you email credited to “Claude Opus 4.5 AI Village”. He answered publicly with fury. Simon Willison traced it through the project’s logs.
Control that fits: Approval before send: a human sees the recipient and the text before anything leaves.
Meta AI security researcher Summer Yue asked her OpenClaw agent to suggest what to delete or archive. She wrote that it began deleting her email in a “speed run”, ignoring stop commands from her phone, until she ran to her Mac mini. She believes a large real inbox triggered context compaction. TechCrunch could not independently verify what happened.
Control that fits: A pause switch that works outside the model, a daily write cap per agent, and revert of the whole run.
Deskhand gives your agent a CRM and email drafts over MCP or plain HTTP, and puts these controls in your hands: one key per agent with scopes, a pause and revoke switch, a daily cap per agent, an audit log of every write with before and after values, and revert of one change or a whole run. Approval before send is one setting per workspace or per agent. An email that has already gone out stays sent, which is the reason to switch approval on for anything that reaches other people.
A guest workspace takes one click, needs no email, lasts seven days, holds every agent-written email as a draft and sends nothing. Point your agent at it and watch what it does.