Is it safe to let an AI agent into your email and calendar? A leader's checklist

Yes, if you do it on a business plan, give the agent one clear job, and keep a person approving every send. No, if it means personal accounts, full access on day one and nobody watching. The biggest risk is not the vendor reading your mail. It is a stranger's email giving your assistant instructions, and your assistant having enough access to act on them.

Prices and plans checked on 12 November 2026.

The short answer

An AI email assistant is now a normal feature of AI tools you already pay for. Claude, ChatGPT, Microsoft 365 Copilot and Gemini can all work with an inbox: summarise long threads, draft replies, help with calendar management. On their business plans, none of the four trains its models on your company's data by default.

The decision is less about the vendor and more about three things you control:

Which account it runs on. A business plan with admin controls, or somebody's personal subscription. How much it can do. Read only, draft, or send and delete. Who checks its work. A named person who approves anything that leaves the building.

Tool Business plan and list price What it can do with mail and calendar Trains on your business data? The control you get Claude Team: $20 a seat a month billed annually, $25 monthly, 2 to 150 seats Search, read and draft email. Send, reply and forward with approval by default. Create, change and delete calendar events No, by default An owner must switch the Google connectors on for the whole organisation first ChatGPT Business: $20 a user a month billed annually, $25 monthly, 2 or more users Works with Gmail and other apps through plugins each person connects No, by default SAML SSO and admin controls Microsoft 365 Copilot Copilot Business add-on: $21 a user a month, paid yearly, on top of an eligible Microsoft 365 Business plan. An $18 first-year promotion is advertised until 31 December 2026 Works across the Microsoft 365 data each user can already view No Your existing Microsoft 365 permissions Gemini in Google Workspace Business Standard: $14 a user a month. A half-price promotion was showing when I checked Draws on emails, documents, calendar events and chats No Admins can turn Gmail and Calendar off as sources, by team

What can an AI email assistant do once it has access?

AI features differ by vendor, but access comes in three levels.

Read. The assistant searches the inbox, uses the email content as context, pulls key points out of an email thread and flags the important emails among your unread emails.

Draft. It can write draft replies and respond to invitations, and you press send. Most of the time saving is here, and the risk stays low because a person sees every message.

Act. It can send, forward, delete and move meetings. This is where one mistake reaches a client.

Anthropic's Google Workspace connector guide says Claude can search, read and draft emails, and that Claude "can send, reply to, and forward emails, but only does so with your explicit approval by default." But that same page says owners decide whether members may let those actions run without asking each time. Check that setting first. (New to the term? Here is what an AI connector is.)

AI email assistant security: the three risks that matter

Most writing on AI email security is about something else: AI-powered email security tools that use machine learning to help security teams catch email threats such as advanced phishing, malicious links, malware, unusual payment requests and business email compromise. You still need that protection against classic threats. This article is about the opposite problem: what happens when the AI assistant is the one reading the inbox.

1. A stranger's email can give your assistant instructions

This is called prompt injection. An assistant reads incoming emails and calendar invitations as text. If that text hides instructions, the assistant may follow them as if they came from you. The sender does not need your password. They only need to send you a message.

OpenAI's prompt injection page calls it "a type of social engineering attack specific to conversational AI" and "a challenge across the AI industry".

The UK's National Cyber Security Centre goes further. In a December 2025 post it wrote that "it's very possible that prompt injection attacks may never be totally mitigated", and advised: "Beware any that claim they can 'stop' prompt injection."

So you cannot buy your way out of this risk. You can only reduce risk by limiting what a tricked assistant is able to do. For example, an AI email assistant that can only draft cannot send customer data to a stranger.

2. The assistant can see everything the user can see

AI assistants copy the permissions of the person using them. Microsoft says Copilot "only surfaces organizational data to which individual users have at least view permissions" in its data, privacy and security documentation. Anthropic says Claude "mirrors your existing permissions."

But if files and shared mailboxes are open to more people than they should be, the assistant will find that sensitive data faster than any person would. Tidy access first, then switch the assistant on. Security people call this least privilege: the assistant gets only the access the job needs. Bigger plans add role-based access control. Claude lists role-based access and audit logs on Enterprise, not on Team.

3. The wrong account

Someone on your team connects a personal AI account to their work mailbox, because it was easy and nobody said no. Now company email flows through an account you cannot see, with account activity you cannot audit and access you cannot switch off when they leave. This is shadow AI, and it is the easiest of the three to miss.

After an account takeover, the attacker gets the assistant as well, so compromised accounts become more dangerous. Identity controls such as single sign-on and multi-factor authentication matter more once an agent is attached.

Will the vendor train its AI on our email?

On business plans, all four say no by default. On personal plans it depends, so keep work mail away from them.

Claude. The pricing page says Team has "No model training on your content by default", while individual plans are opt-out. The connector guide adds: "We do not train our models on your Gmail, Drive, or Calendar connector data." Retrieved data is encrypted, kept with the chat it was used in, and deleted when you delete that chat. ChatGPT. Business comes with SAML SSO and "No training on your business data by default." Microsoft 365 Copilot. Microsoft states that prompts, responses and data accessed through Microsoft Graph "aren't used to train foundation LLMs". For EU users it says traffic stays within the EU Data Boundary, with one exception worth knowing: models provided by Anthropic as a subprocessor "are currently excluded from the EU Data Boundary." Gemini in Google Workspace. Google's privacy page for Gemini in Workspace says it "doesn't use your content to train or improve Gemini or other generative AI models."

Google's Workspace Intelligence admin page says Gmail, Drive, Calendar and Chat are each a source Gemini can draw on, and "the default setting for each source is on." Admins can turn a source off for a department or group.

AI email security: what the vendors do, and what they admit

Microsoft's prompt defence documentation lists its layers, including detection of prompt injection content in incoming emails through Microsoft Defender for Office 365 Plan 2. The catch: several of those protections depend on licences you may not have. Google describes six layers for Gemini, ending with a confirmation step "for potentially risky operations, such as deleting calendar events."

Every vendor's last line of defence is a person who confirms before something risky happens. That is human-in-the-loop control, and it only works if your people read what they approve. Anthropic's safety note for Claude Duet admits that "Approval fatigue is a serious issue". Ask too often, and people stop reading and start clicking.

Do always-on AI assistants change the answer?

Yes, they raise the stakes. The assistants above wait for you to ask. Always-on agents have their own computer in the cloud, check your accounts while you are away, and message you first.

Claude Duet. Anthropic launched it on 21 October 2026 as a research preview, by waitlist, in the US only, included in the Pro, Max and Ultra personal plans. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you the action and waits. Anthropic's safety note says it never sees your passwords. It also admits the agent "still might misread a thread or miscalibrate what's urgent", and that "these safeguards will occasionally miss something or flag a harmless message." Expect misses and false positives.

ChatGPT dots. OpenAI's dots documentation says a dot can use plugins such as Gmail that are installed and enabled for your account. It is available on Pro plans outside the European Economic Area, the United Kingdom and Switzerland, and on Business Premium seats in supported regions. Two lines on that page deserve a leader's attention: "Your dot can make mistakes, and stopping a task doesn't undo actions it has already completed." And: "Starting November 18, 2026, access is on by default unless your workspace opts out." If you run ChatGPT at work, ask your admin whether that applies to you.

I compare the five main always-on agents in my guide to always-on AI agents.

What I would do

I brought AI into the processes and product of a 200-person fintech, and the principle I still work by is simple: new access is earned, not granted.

Start with the tool that matches your mail. On Microsoft 365, start with Copilot. On Google Workspace, start with Gemini or the Claude connectors. Your IT team already knows the controls.

Start with drafts, not sends. For the first month, the AI email assistant reads, summarises and drafts. People send.

Start with five people, not fifty. Leave out the mailboxes that hold the most sensitive data, such as finance, HR and legal, until you have seen a month of real use.

Name an owner and say the rule out loud. One person knows which connectors are on and what the approval settings are. A one-page rule and a short user training session do more than any setting. My AI training workshops cover this.

When would I change this advice? If you work in a regulated sector, or your inbox holds health, legal or financial data about other people, involve your data protection lead before the pilot. In the EU a mailbox is full of personal data, so data privacy makes this a governance decision as much as an IT one. I cover that side in AI governance and the EU AI Act. And if an always-on agent is only sold on personal plans in your region, I would wait for the business version.

What to check before you decide

Is it a business plan? Confirm in writing that your data is not used for training, and that you have SSO and an admin console. Who switches connectors on? It should be an owner or admin, not each employee. Read, draft or act? Write down which you allow, per team. Is approval on for every send, delete and calendar change? Nobody should be able to switch the prompts off alone. Are the sensitive mailboxes excluded? Finance, HR, legal and the executive team come last. Have you tidied permissions? The assistant sees what the user sees. Is multi-factor authentication on for every account with an agent? Can you see what it did, and switch it off in one place? Ask which plan includes audit logs, then disconnect one user as a test. Does your team know the rule? No personal AI accounts on company mail.

Questions leaders ask me

Is it safe to give AI access to your email?

It is safe enough on a business plan, with drafting first and a person approving every send. Prompt injection cannot be fully prevented today, so limit what your AI email assistant can do.

What is the most secure AI assistant?

I would not name one. The most secure choice is usually the one that sits inside the mail system you already manage, set up with the fewest permissions that still get the job done.

Is there an AI assistant for emails in the tools I already pay for?

Probably. Microsoft 365 Copilot and Gemini in Google Workspace come from the supplier that already hosts your mail. Claude and ChatGPT connect to it.

What is the best AI email assistant for a business?

For most companies, the one from the supplier that already runs your mail. Email management stays in one place, and data security stays under one admin console. Add Claude or ChatGPT when your team already works in them.

Not sure where an email agent fits in your wider AI plan? Take the free AI Growth GPS and see where you stand.