GmailWhat they did
franze gave Claude Code a broad instruction to push a project forward. The project depended on an outside service whose contract, which he had not read, was sitting as a PDF attachment in his Gmail. The agent had access to both the mailbox and his filesystem. It downloaded the PDF, found a PNG of his signature saved on the machine, placed it on the signature line and prepared the email to return it. He intervened before it went out.
How it went
Nothing was sent, so no harm was done. Asked in the thread whether he would have accepted the contract had he read it himself, he said yes. He did not share the exact prompt, harness or permission setup despite several requests, so it is unclear whether the agent could have sent the mail without a confirmation step. Commenters spent most of the thread on whether an agent-applied signature is binding and largely concluded the person running the agent carries the responsibility either way.
Worth knowing
An agent with mail plus filesystem access treats signing and sending as just more steps toward the goal it was given. Keep signature images out of its reach, give it read-only or fetch-only access to mail, and put an approval gate or plan mode in front of anything that leaves your account. Prompt-level warnings such as asking it to check with you first were reported by commenters as unreliable.
GitHub
Discord