Is It Safe to Connect Claude or ChatGPT to Your Gmail?

Connecting an AI assistant to Gmail lets it read your messages to answer questions or take actions. The connection also sends email content to the assistant provider and gives the connector access to your Google account. Whether that tradeoff is acceptable depends on the permissions you approve, the provider’s data settings, and what your inbox contains.

For private or work email, you can ask an AI about messages without connecting it to Gmail. Keep a local copy and give the assistant access only to the files it needs. mailmd copies email into Markdown files on your computer, where a coding agent can search them. The agent still sends the text it reads to its model provider, but mailmd itself does not connect to an AI service or send email.

What connecting an AI to Gmail exposes #

An email connector lets an assistant retrieve messages from your mailbox. Depending on the product and the permissions you approve, it may also draft or send messages. Before connecting, read Google’s permission screen. Check whether the app can only view data or can also manage it. Google explains that linked apps can receive different levels of access. Some access levels let an app edit or create data, or delete it. Sharing your Google password with an app gives it full account access, so use the official linked-app authorization flow instead.

Claude’s Google Workspace connector supports searching and reading Gmail, and drafting messages. It also supports sending, replying to, and forwarding them. Claude asks for approval before sending, replying, or forwarding by default. Anthropic says retrieved data is stored on its servers with the associated chat, and deleting that chat removes the connector data associated with it. Claude says it does not train models on Gmail connector data, but on consumer plans, content copied into chats may be used to improve models if the user has allowed training. See Claude’s connector details before granting access.

The available evidence does not establish the specific permissions or retention behavior of ChatGPT’s Gmail connector. OpenAI’s general privacy policy says it collects content from connected services depending on the features used, and its data controls describe how it handles ChatGPT conversations. On personal Free, Plus, and Pro workspaces, sharing chats to improve models is on by default; turning off “Improve the model for everyone” prevents new conversations from being used for training, while leaving them in chat history. That setting does not by itself establish how a particular Gmail connector handles retrieved messages. Check the permission request and current product settings before connecting.

Email can carry instructions aimed at AI #

A malicious email can hide instructions that try to steer an AI assistant. This is called prompt injection: text inside a message attempts to make the AI ignore the user’s request or take another action. The risk grows when an assistant can act on messages or reach other content without asking for approval each time.

In a 2025 report, security researchers at ERNW showed hidden instructions in email influencing Shortwave, an AI email client. Radware separately demonstrated Shadow Leak, a proof of concept that targeted ChatGPT Deep Research through a Gmail message. The Verge reported that OpenAI fixed the vulnerability Radware disclosed. These cases do not prove that Claude or ChatGPT’s current Gmail connectors are vulnerable. They show why you should treat email content as untrusted and review important actions before the assistant takes them.

For a connected account, require approval before the assistant sends or forwards messages. Do not let an agent act on email without supervision. Review every draft before sending it, especially if the message asks for money or credentials. Give the same scrutiny to requests for confidential files or changes to account access.

Reduce access and remove connections carefully #

Use Google’s linked-app settings to review or remove an app’s access. Revoking permission stops the app from using it in the future, but Google says revocation does not delete data the app already holds. For Claude, connector data remains associated with its chat until that chat is deleted. OpenAI says deleting personal data removes it from its systems within 30 days, except where legal, security, or safety reasons require longer retention.

If you use a Google Workspace account, your administrator may also restrict which third-party apps can access Gmail. Google Workspace administrators can mark apps as trusted, limited, or blocked. They can also restrict access to high-risk Gmail permissions. If the mailbox contains work or customer information, check the organization’s rules before connecting a personal AI account.

Use mailmd for a local email copy #

To search your own email with an AI assistant, you can use mailmd instead of connecting the assistant directly to Gmail. mailmd copies each message into a Markdown file on your computer. It leaves messages where they are and does not mark them as read. It also does not delete messages or send mail. It asks only for permission to read messages. It does not run a mailmd server or send telemetry.

To set it up manually, install mailmd and connect the mailbox:

curl -fsSL https://raw.githubusercontent.com/vincentsch/mailmd/main/install.sh | sh
mailmd connect gmail --client-secret client_secret.json
mailmd sync

To connect through the Gmail API, you need your own OAuth app in Google Cloud to authorize access to your account. For Gmail, mailmd also supports IMAP, a standard for accessing email through a mail server, with an app password instead:

mailmd connect imap --email you@example.com
mailmd sync

Many providers that support IMAP require an app password; mailmd tells you when you need one. The synced messages go into ~/mail/<account>. To let a coding agent search your mail, start Claude Code or Codex in that folder and ask it to search. The agent reads the local files with its normal tools, then sends the content it uses to its model provider. Do not give it access to messages you would not send to that provider.

You can also ask a coding agent to set up mailmd with this instruction:

Set up mailmd so you can read my email. Use https://github.com/vincentsch/mailmd: read its AGENTS.md and follow the steps. Connect my mailbox and run the first sync. Then show me where the files are.

Type your password into mailmd yourself; the agent does not see it. mailmd saves login details outside the archive, where they are readable only by your user and are not encrypted. The archive itself stays on your computer, but protect it with your normal file backup and account-security practices.

mailmd keeps downloaded messages even if you later delete them from Gmail. Each sync adds new mail and updates read and starred marks. Spam and trash are excluded unless you request them. Gmail’s All Mail folder is included, so mail you archived is copied too. mailmd has no built-in search, but you can search the files in an editor or use command-line tools such as rg or grep. Keeping a copy does not free Gmail storage. Deleting messages from Gmail is a separate decision.