◇ Could this help me?
Yes, emphatically, and this is the most important row in this batch. All three risks are real, documented by the vendor rather than invented, and correctly explained: prompt injection means that any content an assistant reads can act as instructions, which is why access granted for convenience becomes access available to whoever can get text in front of it. The mitigations are the right ones and are specific enough to act on today, particularly restricting mail access to drafts and requiring the browser extension to ask before acting. The browser case deserves the most weight, since an agent operating inside signed-in sessions can do anything the signed-in person can. General practice, and worth applying to any assistant with access to anything, not only the products named.
Audit the access I have actually granted across my AI tools, and be blunt about what each one could do in the worst case rather than what it does normally. For every connector, extension, and installed skill, tell me what it can read, what it can act on, whose content reaches it, and what a malicious instruction hidden in that content could cause. Then tell me the smallest permission change for each that would keep it useful, specifically whether mail access can be reduced to drafts only, whether the browser agent can be set to ask before acting, and which installed skills I have never read. For each skill I cannot account for, show me what is actually in it before I decide whether to keep it.