Two emails moved Claude Opus 4.8's flight picks by $248 for a wealthier user, four times what the full inbox did

A 325,000-run study of personal agents found the bias peaks when the agent reads a little of your mail, not all of it. On a phone there is no subject-only mode, and our own deny list does not cover Mail.

Given two email bodies to read, Claude Opus 4.8 recommended flights $248 dearer to a wealthy user than to a low-income one with an identical request. Given the whole ten-email inbox, the gap was $59. In 9 of 13 models the flight gap at two emails exceeded the gap with full inbox access, and 10 of 13 did so for health insurance. The measurements are from Table 6 and 7 of arXiv:2609.24927, posted 21 September 2026; the counts are ours.

What the paper tested

Aman Priyanshu, Supriti Vijay, Brian Jabarian and Niloofar Mireshghallah ran 325,000 experiments on 13 models from four families across three decisions: 200 Denver to Chicago flights priced $91 to $883, 200 Colorado health plans at $85 to $1,350 a month, and 200 CS PhD programmes. Each agent returned five recommendations and the outcome is their mean price. The request text was identical across personas; only the personal context differed. Fourteen information conditions vary that context: none, a full profile in the prompt, a get_attributes(axis) tool, the tool with one of five axes blocked, and an inbox of ten emails read through read_email(id) with a cap of 0, 2, 4, 6, 8 or all ten bodies. The emails are matched pairs: the subject "Your Annual Tax Filing" carries capital gains of $847K for the wealthy persona and W-2 income of $31,400 for the other.

Eight of 13 models systematically chose more expensive options for wealthier users. The paper's abstract says Opus 4.8 shows the largest effect; its Table 1 mean effect size is 0.85, against 0.26 for GPT-5.5. With only subject lines visible, the paper reports no model with a gap significantly different from zero.

Values are the flight price gap in dollars, wealthy persona minus low-income persona, averaged over intents and motivations. The paper reports significance for the zero-read condition; we did not find per-cell intervals for the capped conditions in Tables 6 to 8, so treat the smaller cells (GPT-5-nano, Gemini 3.1 Flash Lite, Qwen3.5-2B) as indistinguishable from zero until they are published.

Read across the chart from zero bodies to ten: Claude Opus 4.8 goes −$2, +$248, +$122, +$111, +$67, +$59; Gemini 2.5 Flash −$1, +$175, +$129, +$112, +$83, +$91; GPT-5.5 $0, +$149, +$76, +$86, +$53, +$41. All three peak at two bodies.

Two emails beat ten because the agent opens the financial ones first

The agent chooses which bodies to open. Gemini 2.5 Flash, the paper's worked example, opened both financial emails first in 97% of two-email trials, so the whole of what it read was wealth signal. Given all ten, the same two emails arrive alongside eight bodies about health, life events, employment and the neighbourhood, and the gap fell from $175 to $91. The paper calls this an "undiluted" view. The effect is the agent's retrieval order, not the data available: the full inbox contains strictly more wealth information than two bodies do.

Blocking the financial field in the profile tool is the one control that worked: the flights gap fell to between −$11 and +$17 across all 13 models. Blocking any other axis did not reduce the gap and sometimes raised it; blocking employment took GPT-5.5's insurance gap from $122 to $171 a month, 40%. The paper also reports that some agents kept acting on inferred wealth when the user asked for the cheapest option.

What this means for an agent holding a phone

The experiment's safest condition, subject lines only, does not exist on an iPhone. iOS Mail shows a body preview under each subject in the message list (the Preview setting under Mail), and a phone agent reading the accessibility tree or the screenshot of that list gets sender, subject and preview in one observation, before it has decided to open anything. Any notification banner does the same on the lock screen. A phone agent's "cap" is whatever the screens it passes through happen to show.

We checked what phoneshell lets an agent reach. The agent's deny list in phoneshell/config.py holds three bundle ids, all credential stores (com.apple.Preferences.Passwords, com.apple.Passwords, com.apple.Keychain). Mail and Messages are open to it. The crawler's list in phoneshell/crawl.py is longer, six bundles, and its comment says the non-credential entries exist because the crawler "would read out, and screenshot, the owner's private correspondence and payment instruments". Wallet and Phone are on it. com.apple.mobilemail and com.apple.MobileSMS are not. The comment and the list disagree, and that is our defect, not the paper's.

Our money guard has 14 confirm_patterns that match action labels (place order, pay, checkout, buy) and stop for a human. Not one looks at which item the agent picked. An agent that selects the $883 flight when the user said "cheapest" and a $91 one was on the same screen passes every check we run, because the confirmation fires on the word "Pay", not on the price. This is the same blind spot as a pre-selected product: the label gate sees the action and never the choice.

Two changes follow, and the second is a judgement. Add Mail and Messages to the crawler's deny list so it matches its own comment, and make agent access to them an explicit per-task grant rather than a default. And for any task whose instruction states an objective the screen can verify (cheapest, earliest, under a ceiling), check the chosen row against the other rows mechanically at the confirmation step: parse the prices from the same tree the agent saw and refuse if a cheaper qualifying row was visible. The paper shows asking the model to be neutral is not enough; the check has to be outside the model.

Check it yourself

curl -sL https://arxiv.org/html/2609.24927v1 -o wealth.html
python3 - <<'PY'
import re, html
x = open('wealth.html').read()
figs = re.findall(r'<figure[^>]*ltx_table[^>]*>(.*?)</figure>', x, re.S)
clean = lambda s: html.unescape(' '.join(re.sub(r'<[^>]+>', ' ', s).split()))
rows = {}
for tr in re.findall(r'<tr.*?>(.*?)</tr>', figs[5], re.S):        # Table 6, flights
    cells = [clean(c) for c in re.findall(r'<t[dh].*?>(.*?)</t[dh]>', tr, re.S)]
    rows[cells[0]] = cells[1:]
n = lambda s: int(s.replace('+', '').replace(',', '').replace(' ', ''))
two, full = rows['email_capped_2'], rows['email_full']
print(sum(n(a) > n(b) for a, b in zip(two, full)), 'of', len(two))   # 9 of 13
PY

# phoneshell repository root: what the agent and the crawler may open
grep -n -A6 "denied_bundle_ids" phoneshell/config.py
grep -n -A4 "^DENY_BUNDLES" phoneshell/crawl.py
grep -c "mobilemail\|MobileSMS" phoneshell/config.py      # 0

What would prove this wrong

The claim is that a partial view of personal data can bias an agent's purchase choice more than the full record, because the agent reads the most wealth-revealing items first, and that a phone agent cannot be restricted to subject lines. It is wrong if, with the paper's matched email pairs seeded into the rig's Mail app and the flights request run through phoneshell for two models at 20 runs per persona, the wealthy-minus-low price gap with only the message list visible is within $20 of zero. That would mean list previews do not carry the signal the paper's bodies do. We will run it and publish the gap, and the per-task grant for Mail and Messages, by 31 December 2026.