The idea
All three big assistants can now work with your email. That is useful for four everyday jobs:
- Summarise a thread. Back from leave to a 40-message thread? Ask for the decisions, the open questions and who owes what.
- Find a detail. The delivery date a supplier gave, the version of the contract someone attached, the time of the next call.
- Draft a reply. A first version of the reply you would write, in your tone, for you to edit.
- Tidy the inbox. Archive newsletters, label a project's emails, mark a batch as read.
Illustrations, not real cases.
And one rule for all four: AI drafts, and you send. Or, if an assistant sends for you, you approve each send.
Here is why. Email is the one place where anyone in the world can put words in front of your AI. An agent reads whatever its tools bring back, so a web page or an email can slip instructions into the loop. It's called prompt injection, and nobody has fully solved it yet. Anthropic's own illustration is a planted email, sitting among your ordinary ones, that tells the assistant to ignore your instructions and move money to an account.
So the assistant that reads your mail should ask before it sends, forwards or deletes. In Neosaipien's words: outside words, no power. An agent that reads outside content (the web, outside email, files others sent) may not also send, pay or delete without asking. Set that in the tool's settings; a typed request alone is not a reliable gate.
Summaries can miss things. Google says Gemini can give outdated information, such as an older email when there is a newer one. OpenAI says a broad search or summary of Outlook mail may come back incomplete. So a summary is where you start reading, not where you stop.
Common mistakes
- Letting it send because the draft looked right. Read it as the person who will receive it.
- Trusting the summary without opening the citations, or without checking that the newest email is in it.
- Asking for everything at once ("summarise my inbox", "handle my email"). Broad requests come back incomplete, and a vague brief gives an agent room to act.
- Confirming a bulk delete without reading the list. Gemini gives you 60 seconds to undo; after that it is Trash.
- Choosing Always allow (Claude) or Allow all actions (ChatGPT) for an email app. Keep it asking before it sends, moves or deletes.
- Mixing accounts. With two accounts connected to the same app, check which one a draft will go from.
- Connecting a personal account for work email, or pasting work email into a tool your workplace has not approved.
- Setting a new-mail trigger that replies on its own. Keep triggered tasks to drafts, with approvals on.
What to check before you trust it
- Every point in the summary can be found in an email, and the latest message is included.
- Names, dates, amounts and attachments in a draft match the thread.
- The To and Cc lines are right, and the reply is going from the right account.
- The tone is yours and fits the reader.
- Nothing was sent, forwarded or deleted without you.
- In settings, send, forward and delete ask first.
- These steps cut the risk, they do not end it.
Check it. Open every citation, and read the draft as its reader before you send. More in "How do you review an agent's work before it goes out?"
Keep it safe. AI drafts, and you send. Outside words, no power. More in "What should an agent be allowed to touch?"