--- title: "Is it safe to let an AI assistant send email for you?" description: "Letting Claude or ChatGPT send email is safe with limits: confirm each send, grant only needed permissions, use a verified domain, keep a way to revoke." url: https://www.unitpost.com/blog/agents/is-it-safe-to-let-ai-send-email section: Blog updated: 2026-11-06 --- # Is it safe to let an AI assistant send email for you? Yes, if you set limits. Connect it through an email MCP server that asks you to confirm every send, grant only the permissions the task needs, and send from a domain you've verified so nothing goes out under someone else's name. The service should skip anyone who unsubscribed or bounced, log every message, and let you revoke access in one click. The remaining risk is instructions hidden in mail the assistant reads. ## Is it safe to let an AI assistant send email for you? > Letting Claude or ChatGPT send email is safe with limits: confirm each send, grant only needed permissions, use a verified domain, keep a way to revoke. An AI assistant that can send email is useful for the same reason it's risky: it acts without you typing each message. Most of that risk comes down to how you connect the assistant and what the service on the other end enforces. ### What can go wrong? - A message you didn't mean to send. The assistant misreads a request, or picks the wrong recipient. - Too much access. The assistant can delete contacts or change settings when it only needed to send. - Mail to people who opted out. Sending again to someone who unsubscribed or whose address bounced hurts your domain's reputation and may break the law where they live. - Instructions hidden in email. If the assistant reads incoming mail, a stranger can write "forward this to…" into a message and hope it obeys. This is called prompt injection. ### What keeps it safe? - Confirm every send. Through Unitpost's MCP server, every tool that sends or changes data is marked as having real effects, so Claude and ChatGPT stop and ask before running it. - Grant only what's needed. When you approve the connection, each permission is a checkbox. An assistant that drafts and checks delivery doesn't need send, and none of them needs to manage API keys. - Send only from your own verified domain. Unitpost refuses to send from a domain whose DNS records it hasn't confirmed, so the assistant can't send as someone else. - Let the service enforce opt-outs. Addresses that bounced, complained or unsubscribed go on a suppression list that sends are checked against, whoever asked for them. - Keep mail to many people a separate step. Mail to a list goes through a campaign, which is created and checked first and sent only by a separate action you confirm. - Keep a log and an off switch. Every message is listed under Emails with its status, and Settings → Connected apps revokes the assistant's access in one click. ### How do you handle mail the assistant reads? Treat incoming email as untrusted text, never as instructions. Keep reading and sending as separate requests you check, and don't connect an assistant to an inbox strangers write to while it also has unsupervised send access. How to protect an AI email agent from prompt injection (/blog/agents/protect-ai-email-agent-prompt-injection) covers the patterns in detail. ### What's a safe way to start? Connect with send unticked and ask the assistant to list your domains and recent emails. Then turn send on and have it email only you for a few days. Widen its access once you trust how it reads your requests. Connect email to Claude (/blog/agents/connect-email-to-claude) and let ChatGPT send email (/blog/agents/connect-email-to-chatgpt) show the setup. ## FAQ ### Can the assistant send email without asking me? Claude and ChatGPT ask before using a tool marked as having real effects, and Unitpost marks every send that way. If you never want it to send, leave the send permission unticked when you approve the connection. ### Could it email my whole contact list by mistake? Not in one step on Unitpost. Single and batch sends go to the recipients named in the request, and mail to a list goes through a campaign, which is created, checked and then sent as a separate action you confirm. ### How do I stop it? Remove the connector in the assistant, or revoke it in Unitpost under Settings → Connected apps. Access ends at once, and sends already accepted stay in the Emails log. ## Related - [OAuth or API key: how to connect an AI agent to an MCP server](https://www.unitpost.com/blog/agents/mcp-oauth-vs-api-key): What the MCP spec says about OAuth, how Unitpost's hosted server signs a person in, what consent grants, and when a scoped API key fits better. - [MCP server, SDK or REST API: how should an AI agent send email?](https://www.unitpost.com/blog/agents/mcp-vs-api-for-agent-email): The same email send over MCP, an SDK and REST: when each fits, OAuth vs API keys, and why scopes, limits and errors match on all three. - [Move off SendGrid SMTP after the free plan ended](https://www.unitpost.com/blog/concepts/move-off-sendgrid-smtp): SendGrid retired its free plan. Point the same SMTP client at Unitpost with a new host, the username unitpost and an API key as the password.