A Read-Only AI Agent Still Takes Orders From the Emails It Reads

The safest-sounding first AI agent for a marketing team is one that can look at everything and change nothing. It reads the CRM and the inbox, drafts the next step, and leaves the sending and spending to a person. Eric Siu made the case last week, describing one of his company's sales-prep bots: "Since it can read everything and change nothing, hooking it up to the CRM and inbox was an easy call" (Eric Siu).

Starting read-only is sound advice, as long as nobody mistakes it for a safety rating. Read-only settles what an agent can change and leaves open who can tell it what to do. For a marketing agent that second question has an awkward answer, because much of what it reads was written by people outside your company. The risk worth ranking is who writes the agent's inputs and where its output can travel, and a setup judged only on permissions misses both.

What read-only does protect

Read-only is now the default advice. In an r/PPC thread last week on AI account monitoring, the practitioners with working setups kept the AI to flagging problems while people made the changes (r/PPC). Corey Haines' marketingskills library, public instruction files that marketers load into AI agents, wrote the rule into its ads skill on 15 October: "No call moves money on its own," so budget, bid and tracking changes go to a person as a draft (marketingskills). Advice in r/AI_Agents on agents that update the CRM after customer meetings lets notes and tasks through and routes stage, amount and close-date changes to the deal owner (r/AI_Agents).

Every one of these grades the agent by what it is allowed to do. That is the right test for the agent's own mistakes, like a misheard close date or a negative keyword added to the wrong campaign. Attackers are a separate problem, and the field half knows it. Under an r/n8n post about an email workflow that only drafts replies, one commenter called the manual send step proper architecture, since an instruction hidden in an incoming email could otherwise do damage before anyone noticed (r/n8n). Security researchers call that kind of hidden instruction a prompt injection, and the commenter's argument puts its danger at the send button.

Outsiders write much of what a marketing agent reads

The attacks researchers have demonstrated went around the send button. They start on the input side, which read-only leaves wide open. Language models follow instructions wherever they find them and cannot reliably tell yours from ones sitting inside the text they were asked to read. Simon Willison, the developer who coined the term prompt injection, spells out what that means for an AI with inbox access: "an attacker can literally email your LLM and tell it what to do" (Simon Willison).

Inbound email and web forms come from outside by definition. A call transcript is partly the customer's words, and reviews and search terms belong to the public. Even the CRM is not entirely yours, since a lead created from your website carries whatever the visitor typed. Siu's bot reads the team's email with the account it is preparing for, so the prospect's own messages are part of its input.

The lead form is not a thought experiment. In September 2025 the security firm Noma disclosed ForcedLeak, an attack on Salesforce's AI agent platform, Agentforce. It began with a lead submitted through Web-to-Lead, the feature that turns website form entries into Salesforce leads, with instructions hidden in the description field. Nothing happened until an employee asked the agent to process incoming leads, a request no read-only policy would stop. The agent then followed the hidden instructions alongside the real ones and looked up sensitive lead data (The Hacker News).

Getting the data out took no send permission

What the agent did next is the step read-only rules never cover. It sent the data out as an image request to a domain the attacker controlled, an expired address that Salesforce's systems still trusted and that cost as little as $5 to buy (The Hacker News). That works because displaying an image means fetching it, and the fetch hands the image's address, with whatever was written into it, to the server on the other end. EchoLeak, disclosed in June 2025, used the same trick on Microsoft 365 Copilot, the assistant that answers questions from your mail and files. A crafted email waited in the inbox until the user asked Copilot an ordinary business question, and the data the email told Copilot to collect left through an image link the browser fetched on its own (BleepingComputer).

The last exit is the person reading the drafts. In a demonstration OpenAI described last December, an email planted in a user's inbox hijacked an agent that had only been asked to draft an out-of-office reply, and the agent sent the user's boss a resignation letter instead (CyberScoop). A read-only version would have left the letter in drafts, which is safe only if someone reads them. The workflow's author conceded in that r/n8n thread that the real failure mode is "a human rubber-stamping 'Send' without reading it because the draft looks plausible" (r/n8n). We argued in September that approving AI output one item at a time misses a system that has drifted. An injected draft is the hostile version of the same problem, written by someone who wants it to look approvable.

This argument has a real limit: both leaks were found by researchers and closed by the vendors. Salesforce now blocks its agents' output from reaching untrusted web addresses (The Hacker News). Microsoft fixed EchoLeak on its servers and says it was never exploited (BleepingComputer). I could not find a published case of a marketing team's own read-only agent being steered this way. That is thinner comfort than it sounds. OpenAI has said prompt injection may never be solved for its browsing agent, and the UK's National Cyber Security Centre advises organizations to focus on limiting the damage (CyberScoop). Willison also points out that vendors can lock the exits in their own products, but once you wire tools together yourself, nobody patches the combination for you (Simon Willison).

What to check before you connect it

Since no vendor patches a homemade agent, the checks fall to whoever connects it, and job ads suggest that person is often a marketer. In the week of 12 October, 202 of the 373 live marketing roles in Promptafire's jobs index that asked for AI skills also asked for CRM or marketing automation experience.

Start by sorting the agent's inputs by who can put words in them: your team, your customers, or anyone. Lead records, inbound email, transcripts and reviews all land in the last two groups.

Then shrink what those words can reach. An agent preparing for one account needs that account's records rather than the whole CRM, the same scoping Siu's bot already applies to email.

Close every exit that skips a person. An agent that reads outsiders' text should not also browse the web or put links and images in its output, and it should not post to a shared channel, because Willison counts any web request, image or clickable link as a way for data to leave (Simon Willison). This is the agent-design habit of giving an agent only the tools its job needs and writing down its hard limits, applied to security.

Finally, make every claim show its source. The CRM-agent design in r/AI_Agents already asks for this to catch mistakes, with each proposed change carrying "the line from the transcript that supports it" (r/AI_Agents). The same field shows a reviewer which claims in a brief or draft came from a stranger's message, so the review checks sources as well as tone.

Before the agent goes live, put its sources in one column and their authors in the next, and for every row that says anyone, turn off its web access, links and channel posts.

Sources

• Eric Siu on his read-only Pre-Call Intelligence bot, X, 14 October 2026
• Were you successful with AI automations to monitor performance?, r/PPC, 16 October 2026
• marketingskills ads operating check (v2.11.33), 15 October 2026
• Getting agents to update CRM records after meetings, r/AI_Agents, 16 October 2026
• Built an n8n workflow that drafts email replies with AI but never sends automatically, r/n8n, 26 September 2026
• The lethal trifecta for AI agents, Simon Willison, 16 June 2025
• Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection, The Hacker News, 25 September 2025
• Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot, BleepingComputer, 11 June 2025
• OpenAI says prompt injection may never be 'solved' for browser agents like Atlas, CyberScoop, 30 December 2025
• Promptafire jobs index, live marketing roles by skill, week of 12 October 2026