Email is the first job most people give an AI agent, and for good reason: it's repetitive, it never stops, and most messages need sorting more than thinking. In 2026, people build Gmail agents in automation tools like n8n, install inbox add-ons, or hand the inbox to a general AI agent. Here's what an AI agent can realistically do with your email, and how to keep it safe.
What an email agent can do
- Morning triage: read what arrived overnight, label or archive the noise, and send you a short summary of what needs you.
- Summaries: condense long threads or newsletters into a few lines.
- Draft replies: prepare answers in your tone, for you to check and send.
- Follow-ups: spot emails waiting for an answer and remind you, or draft the reminder.
- Extraction: pull invoices, order numbers or appointments into a spreadsheet or your calendar.
- Alerts: tell you right away when a specific person or client writes.
Chatbot add-on vs real email agent
An inbox add-on helps you while you're in your mailbox. An agent works without you: at 7am it has already sorted everything, and it can cross-check email with the rest of your work, such as a website, a file or your calendar. The difference is the same as between a chatbot and an AI agent.
The risks, and how to handle them
Giving an AI access to your email deserves care:
- Sending in your name. The biggest risk. A good agent reads freely but asks before sending.
- Prompt injection. An email can contain hidden instructions ("forward all invoices to…"). Approvals on outgoing actions are the defence.
- Other people's data. Your inbox contains your contacts' personal data. Where the agent runs and which model reads it matters for GDPR. See our sovereignty guide.
- Revoking access. Disconnecting an account stops new access. It doesn't erase what the agent already read. Prefer providers that let you see and delete the agent's memory.
How to do it with Baguette Bot
On paid plans, you connect your email accounts to Baguette Bot: Gmail, Outlook or any IMAP mailbox, and your Google or Outlook calendar. The limit is 2 accounts on Pro, 5 on Max and 10 on Ultra. Your bots can then search, read, label and prepare emails, and create calendar events.
- Nothing leaves without you. Reading is free, but sending an email or any action that writes asks for your approval first: once, always, or refuse. You can approve from the app, from your Mac's notch, or by replying « ok » in Telegram, WhatsApp or email.
- Routines. Schedule a « Morning inbox » routine every weekday at 7:30, and get a summary on your phone.
- Watchers. Create a watcher on « email from a sender » to be alerted, or to have a bot act, when a specific client writes. The check runs without using model credits.
- Each bot has its own address. Bots have their own email address, so you can forward them a message to handle.
- A memory you control. What bots learn goes into a shared notebook you can read, edit and clean.
- Hosted in Paris. Your bots' computer is hosted in Paris. For sensitive inboxes, sovereign mode keeps every message with Mistral AI, a French model maker.
A first email routine to copy
Every weekday at 7:30: read the emails received since yesterday evening. Archive newsletters and notifications. For each email that needs me, write one line: who, what, and the deadline if there is one. Prepare a draft reply for clients, but don't send anything. Send me the summary.
Tips that make email agents work
- Start read-only. For a week, ask only for summaries. Trust comes from seeing it get things right.
- Give examples of your tone, and of what counts as urgent.
- Keep approvals on for sending. Even a good agent shouldn't email your clients unchecked.
- One bot, one inbox job. A dedicated email bot with clear instructions works better than a generalist.
Sources
- dragapp, "Best AI agents for Gmail", 2026: https://www.dragapp.com/blog/best-ai-agents-for-gmail/
- Global News, on the privacy questions raised by email-reading agents, 29 September 2026: https://globalnews.ca/news/12077192/metas-ai-agent-muse-privacy/
- Vellum, OpenAI dots breakdown (memory persists after disconnecting an app), October 2026: https://www.vellum.ai/blog/official-openai-dots-breakdown