Can AI read my emails? How to check its access

An AI assistant can read email you give it directly or make available through a connected account. An ordinary chat does not gain access to your inbox just because you use the same email address to sign in.

The important question is how the information reached the assistant. Pasting a message gives it that message. Connecting a mailbox can give it ongoing access within the permissions you approve.

Some connections can send emails too. Check the actual permission before treating a connector as a search box.

Find out what you have connected

Open your assistant’s connected-app settings and look for your email provider. Check which account is linked, especially if you have personal and work accounts with the same provider.

Then review access from the email provider’s side. For a Google account, open its third-party connections page and inspect the service’s permissions. Google explains how to review and remove that access.

Signing in and granting mailbox access are different actions. A basic sign-in connection may share profile information without authorising email reading.

OpenAI’s plugin documentation separates identity from permissions to use connected services. Read the consent shown for the connection, rather than inferring access from the presence of a sign-in button.

Check whether it can read or send

Permission names can conceal capabilities you would not expect.

For example, Google’s Gmail permission for composing messages also permits sending them. Google’s Gmail scope reference explains the differences between those permissions.

Claude’s current Google Workspace connector can search and read email. It also supports writing actions, including sending and replying. Its default flow requests approval before those actions, while organisational controls can affect the available behaviour.

Read Claude’s current Workspace connector guide for the account you use.

If you only need help writing a reply, a draft in the chat may be enough. You can copy it into your email app after checking the recipient and the content yourself.

Before approving an automated send, read the final message. Make sure the assistant is replying to the intended conversation, rather than a similarly named contact.

Asking for a narrow search is not the same as narrow permission

“Only look at messages about my holiday” tells an assistant what you want it to do. It does not necessarily limit the underlying account permission to those messages.

Where a service offers a narrower connection, choose it. Otherwise, decide whether the broader access is appropriate for the task.

For a single message, you may prefer to paste a relevant excerpt. Remove the signature and private details the reply does not need. Read quoted history too. A short message can contain a long conversation underneath it.

Email often contains information about people who never chose to use your assistant. A useful reply does not usually require sharing everything they have ever said to you.

Treat incoming messages as material to read

An email can contain instructions that try to redirect an AI assistant. A message that says to forward private information somewhere should not gain authority merely because it appeared in a search result.

This is a form of prompt injection. The NCSC explains why it remains a difficult problem. A natural-language instruction to ignore malicious messages is not a complete security boundary.

Reduce the consequences of a mistake. Keep sending approval on where available, and avoid giving an assistant wider access than the task needs.

Be especially careful when an email asks you to approve a new connection or enter a password. Open the service independently if you need to check the request.

Reuse the useful context with AI Passport

Sometimes you connect email because the assistant needs to understand a project, rather than because it needs the mailbox itself.

AI Passport holds selected personal context that connected assistants can use with your permission. You could save a short project summary instead of making every assistant search the correspondence again.

For example, ask a connected assistant to propose a project memory saying that you are arranging a community event and need draft messages reviewed before sending. Leave attendees’ private contact details out.

Read the proposal before approving it. Then permit the assistant to retrieve the appropriate project context when you need it.

This does not give the assistant live access to your email. Live sources, where available, have separate permissions. Passport’s access model distinguishes selected memory from other information an app may request.

Disconnect access you no longer need

Remove the connection in the assistant and review the email provider’s third-party access page too. Check for scheduled work that still depends on it.

Revocation controls future access. It does not delete messages already copied into a conversation or held by the connected service.

If you shared more than you intended, remove those copies through the relevant service’s controls. When work email is involved, follow your organisation’s process as well.