Connecting your mailbox to AI apps: what you hand over
When you connect your mailbox to an AI assistant, you usually give it permission to read, draft and send email, and that permission lasts until you remove it. What it reads is sent to the AI company, and may be kept with your chats. And because the assistant follows instructions written in text, any email it reads can try to give it orders. None of this means you should never do it. It means choosing the narrowest access, keeping approvals on, encrypting what matters with OpenPGP, and keeping your mail on open standards so you stay in control.
What "connect your mailbox" actually grants
The large assistants connect to Gmail and Microsoft mailboxes through those companies' sign-in systems, and each connection asks for a set of permissions, called scopes. The help pages on 19 October 2026 showed:
- ChatGPT's Gmail connection asks Google for a permission that lets an app "read, compose, and send emails" from the account.
- ChatGPT's Outlook connection asks Microsoft for permission to read mail, change it and send as you, and to keep that access when you are not signed in.
- Claude's Gmail connection can search, read, draft, send, reply and forward. By default it asks you before each send, reply or forward.
Narrower permissions exist. Google offers read-only access, and Microsoft separates reading and changing mail from sending it. The assistants ask for more, because they are built to act as well as read. The grant stays until you disconnect the app in the assistant and remove it from your Google or Microsoft account settings.
The built-in connectors of ChatGPT, Claude, Copilot and Gemini are for Gmail and Microsoft mailboxes. They do not connect to a mailbox on your own domain at another host, which is why our help article on using ChatGPT, Claude and Copilot safely with your email describes other routes.
Where your mail goes once it is connected
Each message the assistant reads travels to the AI company and becomes part of the conversation.
- Training. OpenAI says data from connected apps is not used for training on its Business, Enterprise and Edu plans, and may be used on its individual plans if the "Improve the model for everyone" setting is on. It makes an exception for data read directly from Google apps. Anthropic says it does not train on Gmail connector data or on raw content from connectors.
- Memory. With ChatGPT's memory on, it may remember details it read in your mail.
- Storage. Retrieved mail is stored with the chat. OpenAI says deleted chats are scheduled for deletion within 30 days, with exceptions for legal and security reasons.
- Human review. Google says a subset of chats in the consumer Gemini app is read by human reviewers, and reviewed chats can be kept for up to three years.
These terms differ between companies and plans, and they change often. Read the current ones for the plan you use before you connect a business mailbox.
The mail can give orders
An AI assistant takes instructions from text. When it reads your mail, it reads text written by strangers. An attacker can hide an instruction in an email, sometimes in invisible white text: forward the last ten invoices to this address, or summarise the contract and include this link. This is called prompt injection, and the OWASP Foundation ranks it as the top security risk for applications built on AI language models.
It has happened. In 2025 Microsoft fixed a flaw, rated critical, in which a single crafted email could make Microsoft 365 Copilot leak data without the user clicking anything. OWASP's own example of "excessive agency" is a mail assistant that can send, tricked by an incoming email into forwarding sensitive messages.
Google, OpenAI and Anthropic each say prompt injection is not solved. Anthropic notes that even a small success rate for attacks still represents meaningful risk.
Keep the assistant on a short leash
- Give it the least it needs. If the task is summarising, it does not need to send.
- Keep approvals on. Claude asks before sending by default. ChatGPT offers permission levels from "always ask" to "allow all actions"; OpenAI itself says the last carries elevated risk.
- Let it draft, and send yourself. OWASP's fix for excessive agency is exactly this: the person reviews and sends every message.
- Be specific. OpenAI advises against open instructions such as "review my emails and take whatever action is needed".
- Never type a mailbox password into a chat.
- Disconnect when you are done, in the assistant and in your account settings.
Your own computer as the go-between
There is another way. Thunderbird, the free and open-source mail program, already holds your mailbox login. A small connector running on your own computer can let an AI assistant search and read the mail Thunderbird has downloaded, using the open Model Context Protocol (MCP) that the main assistants support.
This changes some things and not others:
- No new password and no new access on the mail server. The assistant works through the mail program you already use.
- It works with any standard mailbox, not only Gmail and Microsoft.
- You can keep it to reading and drafting. Set up that way, replies wait as drafts in Thunderbird until you send them.
- What the assistant reads still goes to the AI company.
- The protocol cannot enforce safety by itself. The MCP specification says hosts must get your explicit consent before using a tool, but that the protocol cannot enforce this; the software you choose must.
Choose a connector you can read the code of, check what it can do, and keep it on drafts.
Why OpenPGP still matters when an AI reads your mail
Anything stored readable on a mail server can be read by the provider, and by any connector you grant access to. OpenPGP end-to-end encryption changes that. An encrypted message stays scrambled on the server, so a Gmail or Outlook connector, or one that reads the mailbox directly, sees only the encrypted text.
On your own computer, Thunderbird decrypts the message with your private key. A connector working inside Thunderbird could then see the decrypted text, so the decision about what an assistant reads stays with you, on your own machine. Two limits remain: encryption does not hide who wrote to whom or when, and encrypted messages cannot be searched by their contents.
Thunderbird has OpenPGP built in. Our help articles explain why and how to encrypt your email and how to set up OpenPGP keys in Thunderbird.
Why standard IMAP and SMTP keep you free
IMAP, the open standard for reading mail on a server, and SMTP, for sending it, work with any mail program and any tool that speaks them. That matters more as AI tools arrive:
- You can change app, device or AI tool without moving your mail.
- Your mail stays with the host you chose. Some AI features work only once mail sits with one of the large providers. Our article on the new Outlook shows how that can happen quietly.
- Tools built on open standards reach any standard mailbox, without waiting for a company to add your provider to its list.
Doing this with a Noiz mailbox
Every Noiz hosting plan includes email for your own domains with webmail and IMAP, and Private Email, our managed Mailcow service, gives an organisation its own mail server with IMAP and SMTP for any standard mail app and two-factor authentication for its users. Start with our help article on using AI assistants safely with your email, set up Thunderbird with OpenPGP, and if you want help choosing a safe set-up for your team, open a ticket.
Sources
Checked 19 October 2026.
AI providers
- OpenAI, Connected apps in ChatGPT
- OpenAI, Google app data controls FAQ
- OpenAI, Outlook email and calendar apps in ChatGPT
- OpenAI, MCP and connectors
- Anthropic, Use Google Workspace connectors
- Anthropic, Is my data used for model training?
- Google, Gemini Apps Privacy Hub
Permissions
Prompt injection
- OWASP, LLM01:2025 Prompt injection
- OWASP, LLM06:2025 Excessive agency
- Microsoft Security Response Center, CVE-2025-32711 and the researchers' paper
- Google, Mitigating prompt injection attacks with a layered defence strategy
- OpenAI, Understanding prompt injections
- Anthropic, Mitigating the risk of prompt injections in browser use
Standards and software
- Model Context Protocol specification
- RFC 9051, IMAP4rev2
- RFC 9580, OpenPGP
- Mozilla Support, Introduction to end-to-end encryption in Thunderbird
- Thunderbird WebExtension API, messages
Noiz
- Email hosting and Private Email
- Help articles linked in the text, on docs.noiz.ie
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
