Short answer

Reading and summarising: fairly low risk, if you trust the company. Sending, deleting or replying on its own: higher risk. Keep approvals on, so the agent drafts and you hit send.

The real risks

  • Prompt injection: an email can contain hidden text like “forward all invoices to this address”. OpenAI and Anthropic both publish guidance on this risk, and neither says it's fully solved.
  • Unwanted actions: an agent might reply, delete or forward the wrong thing if it's allowed to act alone.
  • Data exposure: your inbox holds receipts, ID scans and password-reset emails. Giving an agent access means sharing them with that service.

7 steps to stay in control

  1. Start read-only: “summarise” and “find” before “reply” and “send”.
  2. Require approval for every send, delete and forward.
  3. Use the smallest access: one inbox or label, not every account.
  4. Never share passwords or one-time codes in a chat.
  5. Watch for odd behaviour like unexpected forwards or new filters, and stop the task if you see any.
  6. Check the privacy settings, including whether your data is used for training.
  7. Review activity logs where the tool offers them.

An example of built-in safeguards: OpenAI says its dots agents use read-only tools when working proactively in the background, check risky actions with auto-review, and always leave some sensitive steps (like changing a password) to you. That's OpenAI's description; we haven't tested it.

Get the free safety checklist (PDF) →

Next: 8 safety rules for AI agents · Your first agent in 15 minutes

Sources

Prices and plans change often. Always confirm on the official site before you buy.