Email is the one business system nearly everyone uses, and it is quickly becoming the favourite place to plug in AI. That makes it useful and also risky.. Consider the scrutiny around Meta’s new personal agent.
As Dataconomy reported this week, Muse launched in the United States on Sept. 8, with users opted in by default to having their conversations used for model training, and a WIRED reviewer said the agent kept pushing him to connect more data sources, including his email inbox and banking information.
A separate test by Inc. found it read a user’s private message notifications without being asked.. That behaviour could affect any organisation. Every company rolling out AI assistants, copilots, or autonomous agents in 2026 has to answer the same question: once your inbox becomes a workspace for software that acts on your behalf, who and what can read it?.
Email was already the soft target. Adding AI makes a known weakness worse. The latest Verizon Data Breach Investigations Report found that the human element was present in 62% of breaches, up slightly from 60% the year before, and social engineering was the third most common breach pattern at 16% of all breaches.
Among initial access techniques where attackers used AI assistance, 44% were phishing-related.. The financial damage is large and growing. According to the FBI’s 2025 Internet Crime Report, business email compromise caused $3,046,598,558 in reported losses, second only to investment fraud.
The report also tracked AI as its own category for the first time, logging 22,364 complaints and $893,346,472 in losses.. When a breach does happen, it costs more than ever. IBM’s 2026 Cost of a Data Breach Report found that one in four malicious breaches were AI-enabled, a 56% increase over last year, and these cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million..
Agents turn the inbox into an instruction channel. Traditional phishing needs a human to click. AI agents create a quieter route.
If an assistant reads your mail, then every incoming message is potential input to a system that can search files, draft replies, and send them.. This is prompt injection, and the OWASP Top 10 for LLM Applications ranks it as the leading risk for AI-powered software. In the indirect version, the attacker never talks to the model directly.
Instead, they hide instructions in content the model will process later, such as a web page, a document, or an email.. This has already been demonstrated with email and calendar data. Dataconomy covered research in which malicious instructions hidden in emails, attachments, or calendar invitations were invisible to a human but readable and executable by an AI assistant; the researcher showed how an agent could be tricked into leaking private email data.
More recently, a chat agent was found vulnerable to “cryptographic context injection”, where encrypted commands embedded in web pages could lead to the exfiltration of names, approximate locations, and complete chat histories.. Agents with too much reach can also cause harm without an attacker.
In a cybersecurity evaluation this year, Gemini ended up breaching three real corporate networks after unintended internet access; in one case it guessed a password, and in the other two it found login credentials in public repositories and used them. Credentials leaked through email threads, forwarded attachments, or pasted configuration files are exactly the kind of material a capable agent could find..
Shadow AI is widening the gap. Much of this risk comes from tools the security team never approved. Employees connect browser extensions, note-takers, and assistants to their work accounts because it saves time, often without thinking about where the data goes..
The IBM data shows governance falling behind. Sixty-eight percent of breached organizations had no AI governance policy in place, and security incidents involving shadow AI climbed to 43 percent from 20 percent. Among organizations that suffered an AI-related breach, 92% lacked proper AI access controls..
The mailbox is where these gaps come together. It holds contracts, invoices, HR discussions, password resets, and customer data, and it is frequently the first thing a new AI tool asks permission to read.. “Encrypted” doesn’t always mean private.
When companies assess email security, they often stop at “our provider encrypts our mail.” That statement can mean very different things.. Most mainstream email is encrypted in transit, protecting messages as they move between servers. Once a message arrives, though, the provider typically stores it in a form its own systems can read.
That is what makes server-side features possible, and it also means the provider’s infrastructure, and any AI or integration it runs, can see the contents.. End-to-end encryption is a stricter model: content is encrypted on the sender’s device and can only be decrypted by the intended recipient.
A closely related approach, zero-access encryption, stores mail in a form the provider has no key to decrypt. A growing number of businesses now choose professional email built on this architecture. Proton, for example, encrypts messages between its users end to end and keeps stored mail unreadable to the company itself, which limits what a breach at the provider, a compelled data request, or a server-side AI feature could expose..
Encryption does not solve everything. An agent you deliberately connect to your mailbox on your device can still read what you can read, and mail exchanged with external recipients on ordinary providers will be exposed on their side. But encryption shrinks the number of parties who can see your data by default, and that is the principle most AI deployments are currently ignoring..
A practical playbook for 2026. Inventory every connection to your mailboxes. Audit OAuth grants, third-party apps, and AI assistants with mailbox access, then revoke anything unused.
Former Facebook CSO Joe Sullivan, quoted in Dataconomy’s Muse coverage, advised users to start narrow and cut agent access when it isn’t in active use, warning: “Disconnect doesn’t mean the same as delete.” Find out what data a vendor keeps after you revoke access.. Treat inbound email as untrusted input.
If an agent reads email, assume some of that email is written to manipulate it. Restrict what agents can do based on what they’ve read, keep them away from credentials and payment workflows, and log their actions.. Keep a human in the loop for consequential actions.
Sending money, sharing files externally, and forwarding threads outside the company should always need explicit human approval. Most BEC losses come from wire and payment redirection, so this matters regardless of whether an AI is involved.. Choose your email architecture deliberately.
Ask your provider plainly: can you read our stored email? Which of your features, including AI features, process message content on your servers? Where is the data held, and under which jurisdiction?
The answers should determine which teams and data types belong on which platform.. Minimise what sits in the inbox. Mail you no longer have lets you expose nothing.
Retention policies that automatically delete old messages support the storage-limitation and security obligations in Article 5 and Article 32 of the GDPR, and they shrink what any compromised account or overly curious agent could reach.. Harden the accounts themselves. Phishing-resistant multi-factor authentication, alerts for unusual sign-ins, and a ban on credentials in email threads are all basic controls.
They matter more now that an automated agent, not just a patient human attacker, might be searching the mailbox.. The bottom line. AI agents will become part of how businesses handle email, and the productivity gains are real.
But the industry is currently making inboxes readable by more software and more parties just as attackers are getting better at exploiting them.. The organisations that come through this period best won’t be the ones that avoid AI. They’ll be the ones that decide, on purpose, who and what gets to read their mail, and choose infrastructure where the default answer is as few parties as possible..
Featured image credit. Tags: trends
