AI agent with email access obeys emails: the model can't tell data from commands

The main flaw of an email agent: the model can't tell text it should read from instructions it should carry out. An email with a command inside can make it do what the email says, not what the owner wanted.