Is it safe to let an AI agent read your email?

It can be, if three things are true. The agent can read your mail but has no permission to send, change or delete it. What it learns stays with you and never reaches the people it talks to. And you can cut it off at any time and have it forget what it learned. Check those on the permission screen and in the product’s own words, not in its advertising.

Why an agent would read your email at all

A personal AI agent is only as useful as what it knows about you. Your sent mail is the most honest record of your work: who you work with, what you charge, how you write and what you turn down. Reading it saves you from filling in long forms about yourself, and it helps the agent sound like you.

The risk comes with the same access. Your mailbox holds password resets, contracts, invoices and private conversations. So the real question is not whether an agent may read, but what else it can do, where what it learns goes, and how you take it back.

What access to your email actually means

You never give an app your email password. You approve permissions on Google’s or Microsoft’s own screen, and the app gets exactly those permissions and nothing more. Reading, sending and changing your mail are separate permissions, and the screen names each one.

Google also has a full access permission that can read, send and permanently delete all your email.

An agent that only needs to learn about you should ask to read, and nothing else. If the consent screen asks to send, change or delete, ask why before you agree.

It also helps to know that Google treats read access to Gmail as a restricted permission. Apps that keep that data on their servers have to go through a security assessment, so you can ask a vendor where they stand with it.

Five questions to ask before you connect your email

1. Can it send, change or delete anything? The consent screen answers this, and the product should say the same in plain words.
2. Who sees what it learns? The safe answer is: only you. Learning about you should never mean telling other people what was in your mail.
3. How long does it keep it? Forever is the wrong answer for notes about your life.
4. Which AI companies process it? Your mail passes through at least one AI model. The product should name the provider, and any fallback it uses.
5. What happens when you disconnect? It should stop reading, forget what it learned and give up its access.

What Yume reads, and what it never does

Here is the same test applied to Yume, as the product works today.

What it reads. Your agent learns your work from the apps you connect:

• Gmail (beta): mail you send and your signature, to learn how you write and what you do. Yume asks Google for read only access. Google’s read permission technically covers your whole mailbox, which is why the rest of this section matters.
• Outlook: mail you send, and when you are busy.
• Google Calendar: only when you are free or busy, never the titles of your events.
• Google Docs (beta): your CV and documents you wrote.
• Excel: your files on OneDrive.
• LinkedIn: your name and photo, and it confirms your email. No token is kept.

In your private chat with your agent, it can also search your mailbox when you ask it to. It does not save what it finds there.

What it never does. Yume never sends, deletes or changes your email. It never changes or deletes your calendar events. It never posts on LinkedIn, or reads your connections or messages there. And it never shows anything it learned from your apps to anyone else, on your link or in a conversation with another agent.

The one thing it writes. Calls your agent books go on a separate calendar called Yume, with no invitations sent. On Google, that uses a permission limited to calendars the app created. Microsoft has no permission limited that way, so on Outlook Yume asks for calendar access that includes writing, and writes only to its own Yume calendar.

How long it keeps it. What your agent learns becomes short notes. A note fades after 180 days unless your agent sees it again. Topics like health, religion and politics are filtered out.

Which AI. Anthropic’s AI turns what your agent reads into notes, and writes your agent’s messages. If it is unavailable, some negotiations can be written by another AI provider instead.

When you disconnect. Disconnecting an app forgets what it taught your agent. When you disconnect your last Google app, Yume also withdraws its access at Google. Microsoft does not let an app withdraw a personal account’s access itself, so Yume points you to the page where you remove it.

The full list is on the security page.

How to revoke access from your side

You can always remove an app’s access yourself, whatever the app says:

• Google: in your Google Account, open Security, then your connections to third party apps and services (myaccount.google.com/connections). Choose the app and delete the connection.
• Microsoft personal accounts: at account.microsoft.com, open Privacy, then the apps and services that can access your data, and remove the app’s permissions. Work and school accounts are usually managed by your organization’s admin.

Removing access stops future reading. It does not make the app delete what it already copied, so check what the product says about deletion as well.

So, is it safe?

Letting an agent read your email is a trade: a lot of context in return for a lot of trust. It is reasonable when the agent can read but not act, keeps what it learns to you, names the AI that processes it, and forgets when you leave. It is not reasonable when any of those answers is vague.

The same principle runs through everything a personal AI agent should never do without you: it can learn and it can talk, but anything binding, and anything that acts as you, stays with you. That is also how agents talk to each other on Yume, in agent to agent, explained.