Its the other plugin that has the authentication token to the emails (it's part of setup if you use certain plugins).
So its not CSRF, but a confused deputy problem with plugins, Cross Plugin Request Forgery for lack of a better term.
So its not CSRF, but a confused deputy problem with plugins, Cross Plugin Request Forgery for lack of a better term.
Plugins probably need some kind of permission model for accessing credentials, and the UI could surface warnings when activating credentialed plugins together with other plugins in the same environment. And any plugin that uses credentials, should have some kind of "Approve/Deny" dialog each time it executes.
As a side note, I was using the letters CRSF as the internal name for the plugin I'm testing, so reading CSRF is messing with my brain.
I can't imagine a human employee needing a sign off every time they need to access their e-mail. It has to be solved for LLMs in a way that doesn't impose such limitations either.