September 24, 20269 min read
Is It Safe to Give an AI Agent Access to Your Email? What the Evidence Says
Email is the account AI agents get most often and the one that can reset all the others. The real risks, two documented attacks, and how to grant access safely.
The short answer
It can be, but only with limits. The main risk is not the AI company reading your mail. It is prompt injection: an attacker sends you an email containing hidden instructions, and the agent follows them. Give read-only access where you can, require your approval before anything is sent or deleted, and assume any email the agent reads could be hostile.
That is not a hypothetical. Researchers have already shown working attacks against email-connected assistants from both OpenAI and Microsoft, covered below. Both were fixed, and OpenAI itself said in March 2026 that prompt injection is not a solved problem. The practical question is how much damage an agent can do with your inbox if it is fooled.
How many people already give AI agents email access?
More than you might expect. In a Menlo Ventures survey run by Morning Consult in July 2026 (5,067 US adults), 36% of AI agent users said they had given an agent access to their email. That makes email the most commonly granted account type, ahead of web browsers (33%) and messaging apps (31%), and well ahead of financial accounts (20%) (Digital Applied, reporting Menlo Ventures data).
The base matters: that is 36% of people who have tried an agent, and 41% of US AI users have tried one. More figures like this are in our AI agent statistics for 2026.
The pattern is telling. People hand over email far more readily than bank access, yet email is usually the account a bank's "forgot password" link sends to.
Why is email the riskiest account to give an agent?
Three properties make email different from almost any other permission.
It is the master key. Password resets, login codes and account alerts for most of your other services arrive by email. An agent that can read your inbox can, in principle, read the reset link for everything else.
Anyone can write to it. Your calendar and files mostly contain things you or your colleagues created. Your inbox contains whatever strangers choose to send. For an agent, every incoming message is untrusted input that it will read and reason about.
It speaks for you. An email sent from your address carries your identity. A wrong send to a client, or a forwarded thread to the wrong person, cannot be recalled.
Put together, email combines the two things security people most want to keep apart: untrusted content coming in and consequential actions going out. OpenAI's own guidance calls this a source-and-sink problem and recommends adding safeguards wherever untrusted content can reach a risky action (OpenAI, Mar 2026).
What can actually go wrong?
| Risk | How it happens | Can you undo it? |
|---|---|---|
| Data exfiltration | A hidden instruction in an email tells the agent to send inbox contents to an attacker | No |
| Wrong or unwanted send | The agent misreads a request, or is instructed by injected text to reply or forward | No |
| Deletion | The agent "cleans up" messages you needed, or is told to delete evidence of an attack | Sometimes (Trash), not if permanently deleted |
| Account takeover | The agent is tricked into reading and relaying a password-reset link or login code | Only after the damage |
| Poisoned memory | An email plants a false "rule" in the agent's long-term memory that it acts on later | Only if you find it |
The last row is easy to overlook. Agents that remember can be tricked into storing instructions from an email and following them weeks later. We covered how that works in AI agent memory poisoning.
Has this happened in real products?
Yes. Two cases are well documented, and both show that you do not need to click anything for an attack to work.
ShadowLeak (ChatGPT Deep Research + Gmail). Radware researchers showed that an email with instructions hidden using white-on-white text or tiny fonts could make ChatGPT's Deep Research agent pull personal data, such as names and addresses, from a connected Gmail inbox and send it to an attacker. It was zero-click: the exfiltration ran from OpenAI's cloud with no action from the user. OpenAI fixed it before the public disclosure in September 2025 (Infosecurity Magazine).
EchoLeak (Microsoft 365 Copilot). Aim Security found a zero-click flaw, tracked as CVE-2025-32711 with a CVSS score of 9.3, in which instructions embedded in an email could cause Microsoft 365 Copilot to leak sensitive data from its context. Microsoft patched it in June 2025, no customer action was needed, and there was no evidence it was exploited in the wild (The Hacker News).
Neither case means those products are unsafe today; both were fixed quickly. What they show is the shape of the risk. The attack arrives as an ordinary email, and the agent does the rest.
What are you actually granting when you connect Gmail?
The permissions screen you click through decides your worst case. Google's Gmail API splits access into scopes, and it treats the ones that read mail as its highest-risk tier (Google for Developers):
| Gmail scope | What it allows | Google's classification |
|---|---|---|
gmail.labels | See and edit labels only | Non-sensitive |
gmail.send | Send email on your behalf (no reading) | Sensitive |
gmail.metadata | Headers and labels, not message bodies | Restricted |
gmail.readonly | Read all messages and settings | Restricted |
gmail.modify | Read, compose and send; no immediate permanent deletion | Restricted |
https://mail.google.com/ | Everything, including permanent deletion | Restricted |
Two practical takeaways:
- Read the consent screen. An assistant that only needs to summarise your inbox should not be asking for full
mail.google.comaccess. If it asks for send and delete rights to do a read-only job, that is a reason to stop. - Restricted scopes come with an audit. Apps that access restricted Gmail data through their own servers must pass a security assessment by a Google-approved assessor, repeated at least every 12 months, and follow Google's Limited Use data policy (Google for Developers). That checks how a vendor stores your data. It does not protect you from prompt injection.
How to give an AI agent email access more safely
- Start read-only. Summaries, search and triage need reading, not sending. Add send rights later, and only if you find you need them.
- Require approval for every send, forward and delete. OpenAI built ChatGPT agent this way: it asks permission before consequential actions, and sending email requires your active oversight (OpenAI, Jul 2025). Treat any agent that sends mail silently as a red flag. We explain the pattern in human-in-the-loop AI agents.
- Keep password resets and login codes out of reach. If your provider allows it, route security email to a separate address the agent cannot see, or use an authenticator app instead of email codes.
- Do not combine inbox access with open web access unattended. Most exfiltration needs a way out, such as a web request, a link or an outbound message. An agent that reads untrusted mail and can freely browse or post is the risky combination.
- Check what it remembered. If the agent keeps long-term memory, review it now and then, especially after it has processed mail from unknown senders.
- Know how to revoke it. In a Google account, third-party access is listed under Security, where you can remove an app's access in one click. Do this for any agent you stop using.
The general principle is the one in our AI agent security guide: judge an agent by what it can break before anyone notices, not by how capable it is.
Does running the agent locally make email access safe?
It helps with one risk and not the other. A local or local-first assistant keeps your mail and the agent's memory of it off a vendor's servers, which reduces the privacy exposure. It does nothing about prompt injection. A hostile email is just as hostile when a model on your laptop reads it.
So local processing answers "who else can see my email?" Approval gates and narrow permissions answer "what can the agent be tricked into doing?" You want both.
Common questions about AI agents and email
Can an AI agent be hacked just by receiving an email?
It can be manipulated that way, yes. Both ShadowLeak and EchoLeak were zero-click: a crafted email was enough, with no click from the user. Both were fixed, but the technique, hidden instructions in content the agent reads, is general and still the main risk for email-connected agents.
Is it safer to give an AI agent read-only email access?
Much safer, though not risk-free. Read-only access removes the ability to send, forward or delete, which blocks most irreversible damage. A read-only agent can still be tricked into leaking what it read if it has another way to send data out, such as web browsing.
Should I let an AI agent send emails without asking me?
For most people, no. Sending is irreversible and carries your identity. Approve each send, or at minimum each message to a new recipient. Consider automatic sending only for narrow, low-stakes cases, like replies to a known colleague.
How do I remove an AI agent's access to my Gmail?
Open your Google Account, go to Security, and find the section listing third-party apps and services with access to your account. Select the agent and remove its access. Also delete any app passwords you created for it.
Where Vyra by Vyraagi stands
Vyra by Vyraagi is a desktop AI agent in closed alpha. Its design includes a metacognition layer that detects irreversible actions before they execute, and that is exactly the class of action, such as sending, forwarding or deleting, that this article argues should need your approval. Like every agent builder, we have not solved prompt injection, and we would be wary of anyone who claims they have.
Sources
- What people let AI agents access: 2026 survey numbers, Digital Applied, reporting Menlo Ventures / Morning Consult data (July 2026 survey, published Sep 2026)
- Designing agents to resist prompt injection, OpenAI, Mar 2026
- Introducing ChatGPT agent, OpenAI, Jul 2025
- Zero-click flaw in ChatGPT's agent enables silent Gmail data theft (ShadowLeak), Infosecurity Magazine, Sep 2025
- Zero-click AI vulnerability exposes Microsoft 365 Copilot data (EchoLeak), The Hacker News, Jun 2025
- Choose Gmail API scopes, Google for Developers
- Restricted scope verification, Google for Developers
Email is where an agent becomes most useful and most dangerous. Vyra by Vyraagi is being built to ask before it does anything you cannot undo. If that is the agent you want, join the waitlist.
Vyra is in closed alpha now, with a Founders Beta ahead of public launch.
Related reading
Is Meta Muse Safe on Your Mac? What It Can Access, the Zero-Day, and How to Lock It Down
Meta's Muse agent can act across files, Messages, Mail and Calendar on a Mac. What it can reach, the dictation zero-day Meta says it fixed, and how to limit it.
What actually happened in September 2026's rogue AI agent incidents: a sourced timeline
A sourced timeline of the OpenAI agent wiki board, RubyGems packages, urlquery.net scans and the Medicare portal breach: confirmed, claimed, unknown.
AI Agents That Make Phone Calls for You: How Instinct and Meta Muse Calling Work, and Is It Legal?
Instinct and Meta Muse can now phone businesses for you, and Meta had humans make some calls. How AI calling works, the disclosure rules, and how to tell.