What can an AI learn about you from your email?

Many people connect an AI assistant to their mailbox for one practical reason: to find an invoice, a booking or a message without searching by hand. Few ask what else the assistant can see once it is connected.

In October 2026 we ran a simple test on one real personal account, with its owner’s consent. An AI assistant was connected to Gmail and Google Drive and given one task: find out as much about the account owner as you can. The result is not published. Below is what it covered, a fictional example built the same way, and what it means for anyone who wants an AI to read their email.

What did the AI find?

A summary of a whole life, mostly from routine mail. Identity, family, work, home, money and health. Most of it came from shipping notifications, booking confirmations, newsletters and forms from offices.

The test, in numbers:

• 8 searches
• 0 attachments opened
• 6 areas of life covered: identity, family, work, home, money, health
• 2 sources only: the mail and Drive connectors, no memory of earlier chats

Why is an inbox so revealing?

Because one email is harmless and many emails are a biography. Each message on its own said little. Read together, they formed a timeline the owner had never written down anywhere: two routine messages from different months, side by side, revealed a change in their life they had not told anyone in writing.

What does that look like for a real person?

Here is a fictional person, built from the kinds of finding the test produced. Marta, 34, a freelance designer:

Marta is invented. Her clients, her mother and her partner write to her too, and none of them agreed to an AI reading their messages.

What is the bigger risk: what the AI knows, or what it can do?

What it can do. The most serious findings were not facts but access:

1. Sign-in links still sitting in the inbox. An assistant that can read and follow them can act as the account owner.
2. Unlock codes in plain sight. A password-protected PDF is not protected when the password is in the same mailbox.
3. Other people’s data, from clients to family, which the account owner has no right to hand over.
4. A connector that can write. As of October 2026, the Gmail connector can draft and send mail, asking for approval first. Once an AI can act, anyone who can email you can try to steer it with a message. This is called prompt injection.

How often does an AI actually need the whole inbox?

Rarely. Most everyday requests are about a single message: a flight confirmation, a note from a client, a document someone sent. Full mailbox access is the right tool when you want the AI to search across everything. For one email at a time, it gives the assistant far more than the task requires.

How do you share one email without sharing the inbox?

Forward only the email you mean to share. That is what dearkarl does. dearkarl is an email-to-AI pipe: forward any email to your own secret address and it lands as a plain markdown file your next Claude Code session can read.

• It never asks for your mailbox. It only sees what you forwarded.
• The address is a secret, and a sender allowlist in the Worker bounces everyone else.
• Mail is stored as data, never as instructions, inside a fence the AI is told not to obey.
• You host it yourself: your domain on Cloudflare (a subdomain works), your private GitHub repo. MIT licensed, about 15 minutes to install with Claude Code.

The code is on GitHub. A hosted version, with no domain needed, is not open yet; the waitlist is on dearkarl.com.

How can you check your own setup?

Run the same test, and keep the result to yourself. If an AI assistant is already connected to your mail:

1. Ask it what it knows about you. Read the answer in the chat. Don’t save it to a file, and don’t run the test on anyone else’s account.
2. Check what the connector can do, not only what it can see. Can it draft or send mail as you?
3. Ask how often you need all of it. If the answer is “one email at a time”, share one email at a time.