When I learned that Notion, the popular online workspace service, was shutting down its Notion Mail product, it wasn’t the shutdown itself that got my attention. No, it was this: because so many Notion users had handed over their email sorting duties to AI agents, they’d stopped bothering to open their inboxes. Letting AI agents sort through all your email has long been considered a killer app for AI, although the convenience doesn’t come without some serious risks.

The concept of delegating email management to artificial intelligence isn't new. For years, services like Google's Smart Reply and Smart Compose have offered limited automation, but the emergence of fully autonomous agents represents a quantum leap. These AI agents can not only categorize messages but also draft replies, archive communications, and even delete spam without human intervention, operating with a degree of independence that raises both practical and ethical questions.

The privacy paradox

First, there’s the privacy aspect. Do you really want AI agents poking through all your email messages? What if they see something personal or spot an account number? Could an agent be tricked (through prompt injection or otherwise) to leak your private data to an attacker or another third party? These concerns are not merely theoretical. In recent years, researchers have demonstrated that sophisticated prompt injection attacks can manipulate large language models into revealing sensitive information, even when the AI is supposed to have strict guardrails. For instance, an AI agent reading an email that contains hidden instructions could be tricked into forwarding that message to an external server, thereby exfiltrating data without the user's knowledge.

Different AI providers offer different levels of protection. Companies like Anthropic (Claude), OpenAI (ChatGPT), and Google (Gemini) have implemented varying degrees of data segregation and user control. Some allow users to opt out of training models on their data, while others encrypt email content end-to-end. However, the reality is that once an AI agent accesses a piece of data, it often must process it on remote servers, which means the data leaves the user's device. This exposes the information to potential breaches or unauthorized access by employees, third-party contractors, or adversaries who compromise the infrastructure.

Beyond data leakage, there are concerns about long-term data retention. Even if an AI company promises to delete your email data after processing, how can users verify that promise? And what happens if the company changes its privacy policy or is acquired by another entity? These questions are especially pertinent for sensitive communications, such as those containing financial information, health records, or legal documents.

Operational risks: when AI goes haywire

Second, there’s the risk of something going haywire. What if the agents mis-file a message or (gulp) deletes your entire inbox, all because of a bad prompt? Or what if the AI sends an email to the wrong person or distribution group? These are not exaggerated fears. In 2023, a lawyer famously used ChatGPT to draft a court filing only to discover that the AI had invented case citations. While that was a text generation error, the same underlying mechanism — reliance on probabilistic models — can cause similar mishaps in email handling. An agent might misinterpret a polite request as spam, flag an important client email as irrelevant, or, worst case, trigger a cascade of accidental deletions due to a misunderstood command.

Moreover, AI agents can suffer from algorithmic drift as models are updated. A system that worked perfectly last month may begin misfiling messages today because the underlying LLM has been fine-tuned or replaced. This unpredictability makes it difficult for users to trust the automation entirely. Most providers, including Claude, have safeguards: Claude can draft email messages but won’t send them without your OK; it can put emails in the trash (where they stay for 30 days) but can’t permanently delete them; and users can opt out of training. But these are not foolproof. A particularly persistent agent, or one with overly permissive instructions, could still cause harm.

The 2024 Notion Mail shutdown is a case in point. Users who had ceded control of their inbox to AI agents found themselves helpless when the service ended. They had no manual routines to fall back on because they had stopped checking their inbox altogether. This dependency creates a single point of failure — if the AI service goes offline or changes its terms, the user's entire email workflow collapses.

The allure of a clean inbox

But there are some tempting upsides too, such as getting a little help plowing through the thousands of unread “Other” messages in my Outlook inbox. It would be a major relief to get a team of agents to sort through all those emails, plucking out the handful of “real” messages and nixing the rest. Many professionals receive hundreds of emails per day, from newsletters, promotional offers, automated notifications, and internal memos. Manually triaging these is a drain on productivity and mental energy. AI agents promise to handle this drudgery, freeing humans to focus on higher-value tasks.

Beyond basic sorting, AI can identify patterns that humans might miss. For example, an agent could notice that a particular client always sends urgent emails late at night and flag those for immediate action. It could learn to recognize phishing attempts based on subtle linguistic cues, or automatically forward invoices to accounting. Over time, a well-trained agent can become an intelligent assistant that anticipates needs rather than just following rigid rules.

The potential for personalized, voice-specific replies is also appealing. As the author notes, Claude Opus 4.8 can draft emails in your own writing style, mimicking tone, vocabulary, and even signature quirks. This could save hours of typing routine correspondence, such as confirming meeting times or thanking contacts for information. However, this feature also carries risks: if the AI misreads the context, it could send an inappropriately casual email to a client or an overly formal one to a friend.

Testing the waters with Claude

It was the thought of my ballooning Outlook inbox that persuaded me to give AI agents a crack at my email — and while I am sorely tempted to enlist their help with my work Outlook, I’m trying it first using a separate Gmail account. (Relax, boss.) As mentioned before, there are plenty of AI providers that offer email integrations, including Gmail. Google’s Gemini, of course, can tap into your Gmail, as can ChatGPT and Notion. I chose to give it a try with Claude, via the Cowork tab in the Claude desktop app.

Claude’s Gmail integration comes with a variety of safeguards, including the fact that it can only draft email messages but won’t send them without your OK. Likewise, Claude can put email messages in the trash (where they’ll sit for 30 days), but can’t delete them permanently. It’s also easy to block Claude from training on your data, including the Gmail it reads. Using Claude Opus 4.8, the current most-powerful Claude model for everyday users, I created a morning Gmail automation: Check all my messages from the past 24 hours, classify each thread as “Important” or “Archiveable,” label the “Archiveable” messages and remove them from my inbox, label anything that looks like a receipt, give me a triaged summary, and then draft replies in my own voice to business or school correspondents, while leaving replies to friends and loved ones up to me.

It’s only been a day since I started my AI-in-my-Gmail experiment, but I’m already seeing results. My inbox is cut down to size, the “unread” count is much smaller, and a few stray receipts have been safely tucked into my “Receipts” folder. Claude hasn’t drafted any email messages yet, but I imagine I’ll see some in the coming week. Am I concerned about Claude sifting through my personal messages? Sure, but not any more than I am about Google doing the same thing. And while the risk of Claude pulling a HAL 9000 with my messages can’t be discounted, the promise of getting my inbox under control is making me willing to roll the dice.

The broader implications of this experiment extend beyond my personal email habits. As more people delegate such intimate tasks to AI, society may need to reconsider norms of digital trust, consent, and liability. If an AI agent accidentally sends a confidential message to the wrong recipient, who is responsible — the user, the developer, or the organization that deployed the system? Legal frameworks are still lagging, and most user agreements contain broad disclaimers that shift all risk to the consumer. This is an area where regulation will likely need to catch up, especially as agents become more autonomous.

Furthermore, there is the psychological effect of not seeing one's own inbox. Some users report feeling relieved when they no longer have to face the overwhelming volume of messages. Others, however, feel anxious, disconnected, or even guilty for not maintaining direct control. This suggests that AI email management is not merely a technical solution but a lifestyle choice that intersects with personality traits and work habits. The Notion Mail shutdown revealed how quickly habits can become dependencies; users who had outsourced their email judgment to AI found themselves unable to make decisions about their own communications.

For now, I'm continuing my experiment. I’ll keep you posted as I gather more data, discover new features, and possibly encounter pitfalls. The road to fully autonomous email management may be fraught with bumps, but the journey itself is already teaching us valuable lessons about the capabilities and limitations of AI agents in our daily lives.

Source: PCWorld News