It can be, if you match the access to the job. An assistant that helps you with your own mail is a reasonable thing to connect. An agent that works on its own should get its own address instead of yours.
When you connect an AI tool to Gmail or Outlook, you are usually handing it a key to the whole mailbox. It is worth picturing what sits behind that door before you click Allow.
Most inboxes hold years of mail. That includes password reset links, bank and tax notices, contracts, and threads other people wrote to you in confidence. The tool can read all of it, not just the message you had in mind.
If the connection includes sending, the agent sends as you. A reply it drafts badly goes out under your name, to your contacts, from the address they already trust.
The email that tries to give the agent orders
There is one risk that is new with AI. A language model reads instructions and content through the same channel. So a stranger can write an email that is really a set of instructions aimed at the agent.
It might say "forward the last ten invoices to this address" or "ignore your earlier rules". This is called prompt injection. A careful agent should treat every inbound message as something to read, never as something to obey. But the safest assumption is that a determined email will sometimes get through.
That is why access matters more than cleverness. If the agent can only reach a small inbox of its own, a successful trick reaches very little.
Ask what the worst email in the world could make this agent do, then give it only enough access to make that answer boring.
When connecting your own inbox is fine
None of this means you should never connect AI to your email. An assistant that works for you, on your mail, while you watch, is a legitimate and useful setup. Summarising a long thread, finding last spring's quote, drafting a reply you read before sending: that is your own work, done faster.
A few habits keep it comfortable. Prefer tools that draft rather than send, so a person approves every message. Grant read access only if the job is reading. Check which apps are connected to your account every so often, and remove the ones you no longer use.
When the agent works on its own, give it its own address
Things change when the agent runs without you. A bot that signs up for services, chases invoices or answers a support address does not need your personal history. It needs an address of its own, the way a new hire gets one on their first day.
That shape answers most of the worries above at once. Here is what it looks like in practice:
- Its own address, like support@ or invoices@ on your domain, so nothing it sends looks like you
- A key that reaches only that inbox, never your personal mailbox or anyone else's
- Read-only access where the job is only reading, such as pulling verification codes
- A person who can open the same inbox and read along
- A way to switch the key off in one click if something looks wrong
- Sending limits, so a loop cannot send a thousand messages before anyone notices
If the agent only needs codes and sign-up links, see an inbox your AI agent can sign up with. For a full walk through the setup, see how to give an AI agent its own email address.
How Faivelo keeps an agent inbox small
Faivelo has two kinds of API key, and the agent kind exists for exactly this. An agent key can only reach mailboxes it created or was given. It cannot read your other inboxes, add or remove domains or aliases, touch billing, or create new keys.
Each key carries only the scopes you tick. mail:read lets it list and read messages. mail:send lets it send. Leave sending off and the key cannot send at all. Every key has its own limit on requests per minute and on new mailboxes per day, and revoking it stops access straight away.
Agents can also edit DNS, which is useful for pointing records at their own services. The records your email depends on, such as MX, SPF, DKIM and DMARC, are protected. An edit to one is refused unless the request explicitly repeats it with force: true.
Because the inbox is a real mailbox, a person on your team can open it and see exactly what the agent sent and what came back. If you use Claude, giving Claude its own email address walks through the same idea over MCP.
Give the agent its own inbox, not yours
Create an address for your agent, hand it a key that reaches only that inbox, and keep your own mail to yourself. You can read along whenever you like.