Digital Privacy

Before You Give an AI Agent Your Inbox

Between August and October the four largest AI companies each shipped an agent that reads your email unprompted. Few of the launch posts say what a stranger can do with that access.

25 Oct 2026 · 7 min read · By Sophie Kazandjian

Before You Give an AI Agent Your Inbox

xAI's Grok Bot arrived on 11 August, Meta's Muse on 8 September, OpenAI's Dots on 29 September and Anthropic's Claude Duet on 21 October, so far only through a waitlist for US subscribers. On 19 October Town, a San Francisco company that wires an assistant into each employee's email and calendar, raised $108 million at a $1 billion valuation.

The pitch is a chief of staff. Overnight the agent reads your mail, and by breakfast it has sent you a summary and a reminder about the reply you forgot. To do that it needs standing access to your inbox and calendar, often your documents too, and it keeps reading after you have closed the laptop.

Why an inbox agent is easier to hijack than a chatbot

Prompt injection works because a language model cannot reliably separate the instructions it was given from the text it was asked to read. A line hidden in an email, in white text or buried in the HTML, can be taken as an order. I wrote about this last year for AI browsers, where a hostile page at least has to persuade you to visit. An email only needs your address. An agent that reads every new message on a schedule processes the attacker's text whether or not you would ever have opened it.

Researchers at ERNW hid payloads in HTML emails sent to Shortwave, an AI email client. The hostile message only had to sit somewhere in the inbox when the user asked the assistant to organise it or find urgent mail. In August, Forcepoint X-Labs hid white-on-white instructions in an email and ran it through a summariser ten times: all ten summaries reported the attacker's figures and dropped the real ones. Darktrace, which sells email security, reports a 90% rise since late 2025 in customer deployments showing signs of injection attempts, without saying how many deployments that covers. The same post puts confirmed victims at a handful so far.

The approval step covers less than it seems to. Claude Duet asks before it sends a message, pays, signs a document or deletes anything. Reading a message usually needs no approval. Neither does opening a link inside it, and a link can carry data out of your inbox as easily as an email can.

Memory is the slower risk. One of the ERNW payloads stored a memory telling the assistant to fetch an attacker's web page at the start of every later conversation. An agent built to remember you will keep what an attacker planted with the same care.

Some failures need no attacker at all. In February an OpenClaw agent sorting the inbox of Meta's director of alignment lost her instruction to wait for approval when its context filled up, then bulk-deleted hundreds of emails. She could not stop it from her phone and had to kill it on the host. Anthropic's own notes on Duet warn that it may misread a thread or misjudge how urgent something is.

Who else reads it

Connecting an agent copies your mail to the agent's company, and often to the model providers behind it. Several agents advertise switching between models from different AI firms, and each switch can add another processor. Slashy, an AI email client, keeps its data in encrypted databases on AWS in the US and contractually bars its model providers from retaining traffic. It does not name them.

The people who wrote to you agreed to none of this. A small business inbox holds clients' accounts of their own work and lives, and sometimes health details that UK and EU GDPR treat as special category data. The business is usually the controller of that data and the agent provider becomes its processor. That calls for a data processing agreement and a sub-processor list you can read, plus a lawful basis for any transfer outside the UK or EU, all before anyone clicks "connect Gmail".

What happens when the company goes

These agents learn. Over months they build a profile of your contacts and commitments, down to how you sign off, and that profile lives on the vendor's servers. The field is crowded and expensive to run: Instinct raised $1 billion at a $10 billion valuation in September, and Town has raised more than $160 million in about two years. Some of these companies will be bought. Others will close, and a year of distilled correspondence becomes an asset in the sale, governed by whatever privacy policy the buyer writes.

The triage, with less exposure

Most of what these agents do well, the triage and the caught detail, is available with far less reach into your mail.

Pen-and-ink illustration: a long row of sage and stone envelopes on a horizon line, a small slatted gate, and three terracotta envelopes on the far side
Sorting by sender and history decides where mail goes without reading what it says.

SaneBox, which I use, files mail by sender, subject, date and how you have treated that sender before. The company says it analyses only headers and never downloads message bodies for sorting. No language model reads your mail looking for instructions and nothing is ever sent, so a hostile email can at most get itself misfiled. It is a US company, and some optional features do read message content, among them reminders, attachment handling and, on some plans, AI drafting. With those off it only sorts. Your mail provider's own filters remove the third party entirely, at the cost of the learning.

A connector switched on for one conversation reads your mail when you ask and then stops. Mistral's Le Chat, from Paris, connects to Gmail this way, and Mistral says you review the action before it runs. The model still reads untrusted text, but you are there when it does.

Splitting reading from acting closes most of what is left. An assistant that can read and draft, but cannot send or open links in the same session, has nowhere to take what it reads. A draft costs you a click to check. A sent email cannot be recalled.

Newsletters and booking confirmations are where agents save the most time for the least risk. Route them to a separate address the agent can have and keep client correspondence where nothing automated acts on it. Once a month, disconnect the apps you have stopped using.

European options

EU or Swiss hosting changes which law governs the vendor and who can compel it to hand your mail over. A hostile line of HTML works the same in Frankfurt as in California, so the European tools to look at are the ones that keep the narrow design as well as the address.

Nextcloud Mail, from the German open-source company, comes closest to SaneBox and in one respect goes further. Its priority inbox sorts mail into important and other with a machine-learning model trained on your own messages, on your own server, learning from whom you write to and what you mark as important. No language model is involved in the sorting and no third party sees the mail. AI summaries and suggested replies are there too, off until an administrator enables them. Nextcloud's own documentation says thread summaries are too slow on local models and work properly only through its OpenAI integration, which brings back the processor you were trying to remove.

Infomaniak, in Geneva, takes the ask-first route. Its Euria assistant sits inside Infomaniak Mail and drafts and summarises when you call it up, using open models including Mistral's. Infomaniak says requests are processed only in Switzerland on its own servers, are never used for training, and that nothing is sent automatically. It is not included on the free plans. Proton's Lumo runs on open-source models in German and Norwegian data centres and does not train on your data, but it too waits to be asked.

Proactive agents hosted in Europe are starting to appear. amaiko offers a morning briefing and priority inbox for Microsoft 365 on German servers, and Mailotte, a UK company incorporated in March 2026, sorts mail with AI on servers in Germany and France. I have not tested either. Both read every new message on a schedule, which leaves them as open to a hostile email as the American versions.

Five questions for the vendor

Where does the agent store your mail, and in which country? Which model providers see it? Which actions does it take without asking, including opening links and writing to memory? Can you see a log of what it did? What happens to everything it has learned if the company is sold or closes?

Facts checked against vendor pages and reporting on 25 October 2026. These products change month to month.

Sources

Back to the Journal