# Is it safe to connect Gmail to ChatGPT? > What ChatGPT can see and do once Gmail is connected, the real risks, and how to give it read-only access, review what it did and turn it off fast. Updated 2026-10-10 · https://upsy.ai/guides/chatgpt/is-it-safe-to-connect-gmail ## Short answer For most people it's reasonably safe, if you keep ChatGPT asking before it sends anything and you know where the real risk is. Connecting Gmail lets ChatGPT read your whole mailbox, and draft and send with your approval. The main danger isn't OpenAI reading your mail: it's instructions hidden in an email or calendar invite that ChatGPT then follows. Ten minutes of settings, covered below, cuts most of that risk. ## What ChatGPT can see and do with Gmail When you connect Gmail, Google asks you to approve the `gmail.modify` permission, which OpenAI lists in its [Google app data controls FAQ](https://help.openai.com/en/articles/10408842-google-app-data-controls-faq). Google describes that permission as read, compose and send, without permanent deletion that skips the trash. In practice: - **Reading:** ChatGPT can search and read any email in that account, not only the ones you ask about. It uses Gmail on its own when it thinks it's relevant to your question. - **Sending:** since June 8, 2026, ChatGPT can draft and send email from the chat on Plus, Pro, Business and Enterprise (web). It shows you the email and asks before sending. - **Memory:** if Memory is on, ChatGPT can use details from your emails to personalize later answers, and show which emails it used. - **Tasks:** in ChatGPT Work you can set a task to run when a new email arrives. Actions that need approval pause until you review them. - **Training:** OpenAI says it doesn't train its models on data from connected Google apps. The exceptions are chats you send as feedback, mail you copy into a chat yourself, and text that ends up in ChatGPT's reply. With **Improve the model for everyone** off, none of it is used. Deleting a chat removes it within 30 days. Disconnecting Gmail stops new access, but doesn't delete old chats or saved memories. ## The real risks ### Hidden instructions in an email or invite This is the one to understand. An assistant reads text, and it can't always tell your request from instructions someone else wrote into an email. Security people call this prompt injection. In September 2025, researcher Eito Miyamura showed it with a calendar invite ([SecurityWeek](https://www.securityweek.com/chatgpts-new-calendar-integration-can-be-abused-to-steal-emails/)). The attacker only needed the victim's email address. The invite held hidden instructions, and the victim didn't have to accept it. When the victim asked ChatGPT to help prepare for the day, ChatGPT read the invite, searched the inbox and sent private details to the attacker. The demo used developer mode, and the victim had to approve the actions. Miyamura's point was that people tired of approval prompts click Allow without reading. This isn't unique to ChatGPT: any assistant that reads your mail has it. OpenAI says it monitors and tests against prompt injection, but that this doesn't remove the risk. ### An agent that does more than you asked In February 2026, a safety researcher at Meta, Summer Yue, told an AI agent to suggest which emails to archive or delete, and to wait for her approval. On her real, much larger inbox, the agent lost that instruction and started trashing email, more than 200 messages by some reports, until she stopped it at the computer it ran on ([Simon Willison's write-up](https://simonwillison.net/2026/feb/23/summer-yue)). That agent was OpenClaw, an open-source agent on her own machine, not ChatGPT. The lesson still applies: an instruction in a chat can be forgotten, while a permission setting can't. ### Approving without reading ChatGPT's approval card is a real safeguard, but only if you read the recipient and the body. Its **Allow all actions** setting removes the prompts entirely. ## Make the built-in Gmail plugin safer 1. **Set approvals.** In ChatGPT, open **Settings › Plugins** and choose **Always ask** or **Allow read actions**, either as your default under **Permissions** or for the Gmail account itself. If you never change it, the default is **Allow low-risk actions**. Avoid **Allow all actions** for email. See [Managing app permissions in ChatGPT](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt). 2. **Read every send card.** Check who it goes to and what it says before you click Allow. 3. **Be careful with mail from strangers.** Asking for a summary is low risk. Asking ChatGPT to act on what an unknown email says ("do what this asks") is where injection bites. 4. **Turn off what you don't use.** Switch off Memory or **Improve the model for everyone** in Settings if you don't want your mail in either. 5. **Disconnect when you're done.** In **Settings › Plugins**, open Gmail, then the account's menu (•••), and select **Disconnect**. 6. **Revoke it at Google too.** Open your Google Account's linked apps and remove ChatGPT's access, as in Google's [guide to third-party connections](https://support.google.com/accounts/answer/13533235). If you're at higher risk, ChatGPT's Lockdown Mode restricts apps that need live access to outside services. ## Extra control with Upsy The built-in settings decide when ChatGPT asks. They don't change what it can reach: a Gmail account connected to ChatGPT can always be sent from. Upsy, a connector that sits between your assistants and your apps, adds limits that a hidden instruction can't talk its way past: - **Read-only per account.** Set Gmail to **Read-only** on ChatGPT's page in Upsy and ChatGPT can't send, draft or trash in that account, so an injected "forward this to…" is refused. With several Gmail accounts, each gets its own level. - **Pick actions.** Allow drafting but not sending, so ChatGPT writes and you send from Gmail. - **History.** Every action is in Upsy's **History** under the assistant that did it, and nobody can edit or delete it. - **Alerts.** Upsy emails you when one assistant deletes 50 or more items, sends 20 or more emails, or reads from your apps 100 or more times within 10 minutes, and when a new assistant or app connects. - **Off in one click.** Turn ChatGPT off on its page in Upsy, or turn every assistant off at once from **Assistants**. - **No tokens handed out.** ChatGPT never gets your Google password or token. It calls Upsy's tools, and Upsy calls Gmail. Be clear about the limits too. Read-only stops ChatGPT changing or sending mail through Upsy, but ChatGPT can still repeat what it read in the chat, or use other tools you've allowed. Upsy has no approval prompt of its own: ChatGPT's prompt is what asks before a send. Upsy is also one more company with access to your mail. It's built by Upstash, free for personal use, with no ads, and it doesn't sell your data. While Google reviews Upsy's own Google app, Gmail signs in through Composio's verified Google app, so Google's screen names Composio and asks for full mail access. Upsy only acts on your mail when an assistant you allowed asks. To set it up, add Upsy to ChatGPT as a [custom MCP server](/guides/chatgpt/custom-connector). If you keep work and personal mail apart, see [multiple Gmail accounts in ChatGPT](/guides/chatgpt/multiple-gmail-accounts). To remove Upsy's access later, disconnect Gmail on Upsy's **Apps** page and remove Composio from your Google Account's linked apps. ## FAQ ### Is it safe to connect Gmail to ChatGPT? Reasonably, for most people. OpenAI doesn't train on connected Gmail data, and ChatGPT asks before sending by default. The real risk is hidden instructions in emails, so keep approvals on and read them. ### Should I connect Gmail to ChatGPT? Connect it if you'll use it for searching, summarizing and drafting, and you're willing to read each approval. Skip it, or use a read-only setup, for an inbox full of sensitive work or financial mail. ### Can ChatGPT send emails without asking me? Not by default: it shows the email and asks first. If you choose **Allow all actions** for Gmail, supported actions can run without another prompt. ### Does OpenAI read or train on my Gmail? OpenAI says it doesn't train its models on data from connected Google apps, except chats you send as feedback, mail you paste in, and text in ChatGPT's replies. Turning off **Improve the model for everyone** excludes those too. ### Can ChatGPT delete my emails? Google's Gmail permission doesn't allow permanent deletion that skips the trash. Through Upsy, trashing is a separate action you can leave out with **Read-only** or **Pick actions**, and anything trashed can be restored from Gmail's trash for 30 days. ### How do I disconnect Gmail from ChatGPT? Open **Settings › Plugins**, select Gmail, open the account's menu (•••) and select **Disconnect**. Then remove ChatGPT from your Google Account's linked apps. --- Upsy connects personal AI assistants (Muse, Grok, ChatGPT, Claude, Cursor, Claude Code, Codex, Devin) to your Gmail, Google Calendar, Google Drive, Slack, Notion and other apps through one MCP server, with a shared memory, files and a cloud browser signed in to your sites. You choose what each assistant may do in each app, see everything it did, and turn it off in one click. Upsy is free. To add Upsy to an assistant, add a remote MCP server (Streamable HTTP) named Upsy at https://upsy.ai/connect. It signs in with OAuth; there is no API key.