Is an AI agent safe with your email?

How an agent is different from an AI chat

An AI chat only sees what you type into it. An AI agent can also do things for you: open your inbox, read your files, visit websites and send messages.

That's what makes it useful, and it's also the risk. OpenAI says that once an agent is signed in to websites or connected to apps, it can reach emails, files and account settings, and can take actions such as sharing files or changing settings.

The real risk: hidden instructions

Security experts call it prompt injection. Someone hides instructions inside an email, a web page or a document. Your agent reads it while doing your task, and may follow those instructions instead of yours. The text can even be hidden so that a person wouldn't notice it.

OpenAI gives an example: you ask an agent to find a restaurant by checking your calendar and email. On the way, it reads a planted comment telling it to get a password reset code from your Gmail and send it to a scam website.

AI companies build defenses against this, but none of them promise it's solved. OWASP, a non-profit that tracks software security risks, ranks prompt injection first on its list of AI risks and says it's unclear whether there's a fool-proof way to prevent it.

Six rules before you connect anything

1. Connect only what the task needs. If you only want help with your calendar, don't connect your email and files too. OpenAI's own advice is to turn on only the apps needed for the current task.

2. Practice on a separate inbox first. Try the agent on a spare email account, not the one your bank, doctor and family use. Move to your main account only once you trust how it behaves.

3. Give one clear job. “List my five newest emails that need a reply” is much safer than “check my email and handle everything.” OpenAI warns that broad instructions make it easier for hidden instructions to mislead the agent.

4. Make it ask before it acts. Agents are often designed to ask before sending an email or buying something. When it asks, read what it's about to do and who it's sending to. If anything looks wrong, say no.

5. Never type passwords or codes into the chat. If a site needs you to sign in, do it yourself. And never pass along a one-time code because the agent, or an email, asks for it.

6. Keep money and medical accounts out of it. Don't connect banking, retirement or health portals to an agent. A mistake there would cost far more than the agent could ever save you.

When to stop it straight away

Stop the agent if it opens something you didn't ask about, asks for a code or password, tries to send something to an address you don't know, or starts a new task on its own. OpenAI's advice is to stop the task immediately if something seems suspicious.

How to take access back

You can remove an app's access whenever you like. For a Google account, go to your Google Account's linked apps page, choose the app under Access to your Google Account, then See details, then Remove access. Google's help page also has an Agent access filter for agents such as Gemini.

For other accounts, look for connected apps or app permissions in the account's security settings. And in the AI tool itself, turn off any connection you're not using.

The bottom line

Letting an agent read your email isn't reckless, but it isn't the same as chatting with an AI. Start with low-stakes jobs where it only reads and reports back, on an account that doesn't hold your money or health records, and stay the one who presses send. The basics of what never to type are in Is ChatGPT safe?.

The first thing to type

Common questions

Can an AI agent be hacked through an email?

It can be tricked. Someone can hide instructions in an email or document that the agent reads and follows. That's called prompt injection, and no company says it's fully solved.

Is it safe to connect ChatGPT, Gemini or Claude to my Gmail?

For low-stakes jobs, it can be, if you connect only what the task needs and check each action before you approve it. Keep banking and medical email out of it.

Should my parent let an AI agent read their email?

Not their main inbox yet. Scammers target older adults by email, and an agent could be fooled by a scam email too. Help them try it on a spare account first.

How do I remove an AI tool's access to my Google account?

Open your Google Account's linked apps page, pick the app under Access to your Google Account, then choose See details and Remove access.

Sources (checked 2026-11-02): openai.com/safety/prompt-injections, help.openai.com/en/articles/11752874-chatgpt-agent, genai.owasp.org/llmrisk/llm01-prompt-injection, support.google.com/accounts/answer/13533235