Is it safe to give an AI agent access to your email, CRM and bank?
Short answer
An AI agent can be safe with email, CRM and bank access if it gets only the access each task needs and a person approves anything that moves money, emails a customer or deletes data. OWASP's Top 10 for LLM Applications 2025 ranks prompt injection as the number one risk, and the UK's National Cyber Security Centre (NCSC) wrote in December 2025 that it may never be fully mitigated. Safe design limits what a fooled agent can do.
Deniz SancarFounder of Yarigai, London. Updated .
Yarigai is a done-for-you AI agency that builds these systems, so read this with that in mind. Every price and figure links to its source below. Read this page as Markdown.
At a glance
| Question | Answer, November 2026 |
|---|---|
| Top risk for AI applications | Prompt injection, LLM01 in OWASP's Top 10 for LLM Applications 2025 |
| Can prompt injection be fixed | The NCSC says there is "a good chance" it "will never be properly mitigated" |
| Risk from too much access | Excessive agency, LLM06, caused by excess functionality, permissions or autonomy |
| Do OpenAI, Anthropic and Microsoft train on business data | Not by default on business plans and APIs |
| How long API providers keep prompts | OpenAI keeps abuse-monitoring logs for up to 30 days; Anthropic keeps none by default, except 30 days for its Covered Models |
| Actions that need a person | Payments, emails to customers and deleting records |
| UK GDPR | The business stays the controller; the ICO lists AI as innovative technology that can require a DPIA |
What can go wrong when an agent has access
The risks fall into four groups. Someone hides instructions in content the agent reads, the agent holds more access than it needs, data sits with a provider longer than expected, or the agent gets something wrong on its own.
Prompt injection from emails, documents and web pages
Prompt injection is text that changes what the model does. OWASP calls it indirect when the model "accepts input from external sources, such as websites or files". An agent that reads email reads text written by strangers, so every inbound email is a possible instruction.
The NCSC explains why this is hard to fix. Language models "simply do not enforce a security boundary between instructions and data inside a prompt". In its 8 December 2025 post, "Prompt injection is not SQL injection (it may be worse)", it advises reducing the impact instead of hoping for a cure.
Over-broad permissions
OWASP names this risk excessive agency and gives three causes:
- Excessive functionality, where the agent has tools it doesn't need.
- Excessive permissions, where those tools reach further into other systems than the task requires.
- Excessive autonomy, where high-impact actions run without anyone checking them.
OWASP's own example is an email assistant. It needs to read messages to summarise them, but the plugin it uses can also send messages. A crafted email then tells the agent to search the inbox for sensitive information and forward it to an attacker. The fix is a plugin that can only read.
Data retention and training
Business plans and paid APIs from OpenAI, Anthropic and Microsoft don't train on customer data by default. Retention still varies.
- OpenAI says API data is not used for training unless the customer opts in, and keeps abuse-monitoring logs for up to 30 days.
- Anthropic says API prompts and outputs are not retained by default. Its Covered Models (Fable and Mythos) need 30-day retention, and flagged content may be kept for up to 2 years.
- Microsoft says Copilot prompts, responses and Microsoft Graph data "aren't used to train foundation models".
Consumer accounts differ. OpenAI's Free, Go, Plus and Pro plans list training as "Opt-out available", so staff should not connect company email to personal accounts.
Wrong actions
Agents also make mistakes without any attacker. OWASP lists hallucinations among the triggers for excessive agency, alongside prompt injection. A wrong refund, a reply to the wrong client or a deleted record costs the business, whatever caused it.
Which controls work
No single control stops prompt injection, and the NCSC warns buyers to "beware any that claim they can 'stop' prompt injection". The controls that work limit the damage a fooled or mistaken agent can do.
| Control | What it does | Basis |
|---|---|---|
| Least-privilege access | Each tool gets only the actions its task needs | OWASP LLM01 and LLM06 |
| Read-only first | The agent reads and drafts during a pilot, and gains write access step by step | OWASP LLM06 email example |
| Human approval for high-risk actions | A person approves payments, customer emails and deletions | OWASP LLM01 and LLM06 |
| Separate service accounts | The agent signs in with its own account scoped to its task, never a shared admin login, so its access is logged and easy to revoke | OWASP LLM06, minimise extension permissions |
| Untrusted content kept apart | Text from emails, files and web pages is labelled as data, and agents that read outside content don't hold privileged tools | OWASP LLM01; NCSC |
| Hard limits outside the model | Code enforces payment caps, recipient allow-lists and rate limits, whatever the model says | NCSC; OWASP LLM06 |
| Logs and monitoring | Every input, output and tool call is recorded and reviewed | NCSC; NCSC secure AI guidelines |
| Paid tiers with no-training defaults | Business plans or APIs, under a data processing agreement | Provider data pages |
Least privilege and read-only first
Start every agent with read access and drafts. An inbox agent that drafts replies into a folder can't send a bad one. Add write access one action at a time, after the read-only version has run on real work for a few weeks.
A person approves money, customer emails and deletion
OWASP lists human approval for high-risk actions as a mitigation for prompt injection and for excessive agency. Some providers build this in. Anthropic's Gmail connector for Claude can send, reply and forward, and by default it asks the user to approve each of those actions.
Deterministic safeguards
The NCSC advises designers to "focus more on deterministic (non-LLM) safeguards". In practice that means rules in ordinary code that the model can't talk its way past, such as a maximum payment value, a list of approved payees or a cap on emails per hour.
Logs
The NCSC says systems should log "enough information to identify suspicious activity", including inputs, outputs and tool or API use. Its Guidelines for secure AI system development, published on 27 November 2023, list logging and monitoring under secure operation and maintenance.
What access to give for email, CRM and bank
Give each system the narrowest access that lets the agent do its job, and keep a person on every action that a customer sees, that moves money or that can't be undone.
| System | Start with | Add after a pilot | Always needs a person |
|---|---|---|---|
| Read and draft only; drafts saved, not sent | Internal notifications and replies from approved templates | Any email to a customer or supplier written by the agent | |
| CRM | Read records, add notes and tasks | Update fields such as deal stage or owner | Deleting or merging records and bulk changes |
| Bank and accounts | Read-only transaction data through the accounting software | Draft invoices or draft payment runs | Approving any payment and changing payee details |
Never give an agent the business's online banking login. An agent that reads transactions through the accounting software's bank feed can reconcile and chase invoices without the power to pay anyone.
UK GDPR and ICO points
Under UK GDPR the business stays the controller of the personal data its agent processes, and the AI provider usually acts as its processor. Microsoft, for example, says it acts as a data processor for Copilot under its Data Protection Addendum.
Five points come from ICO guidance and provider terms:
- Do a data protection impact assessment (DPIA) first. The ICO requires one where processing is likely to result in high risk, and its list includes "innovative technology", which it says covers AI, when combined with other risk criteria.
- Give the agent only the fields it needs. An agent that chases invoices needs names, amounts and due dates, not full customer histories.
- Use a paid tier and sign the provider's data processing terms. OpenAI supports customers signing a Data Processing Addendum, Microsoft covers Copilot under its Data Protection Addendum, and Anthropic's API documentation names Anthropic as the data processor.
- Check where data is stored and processed. OpenAI's UK API endpoint stores data in the UK but does not process it there. Its Europe endpoint does both.
- Keep a person in decisions about individuals. The ICO's guidance on AI and data protection covers fairness and solely automated decision-making. It was last updated on 15 March 2023, and the ICO says it is under review after the Data (Use and Access) Act.
A checklist to give any agency
Send these twelve questions before signing, and ask for the answers in writing. An agency that can't answer them has not planned for the risks above.
- Which accounts will the agent use, and are they separate service accounts in our name?
- What exact permissions does each account have, read or write, system by system?
- Which actions need a person's approval, and how does that approval work?
- How do you reduce the risk of instructions hidden in emails, documents or web pages? Expect "reduce", not "stop".
- Which AI provider and plan will you use, and is it a paid tier that doesn't train on our data by default?
- Is there a data processing agreement with the provider, and who signs it?
- How long does the provider keep prompts and outputs, and where are they stored and processed?
- What hard limits sit outside the model, such as payment caps, recipient allow-lists and rate limits?
- What does the agent log, where, for how long, and can we read the logs ourselves?
- How did you test it on our own data before go-live, including deliberate injection attempts?
- Who carried out the DPIA, and can we have a copy?
- How do we switch the agent off and revoke all its access in one step?
The guide to choosing an AI agency covers the commercial questions, such as price, ownership and support.
How Yarigai builds agents that touch email, CRM and money
Yarigai is a done-for-you AI agency in London that builds AI agents, inbox triage, CRMs built around a client's sales process, invoice chasers and receipts into Xero or QuickBooks. It builds them inside the client's own accounts and tools, so the client owns the code, the data and the accounts from day one and controls who and what can use them.
A person approves anything that sends money, emails a customer or deletes data. The client pays AI and hosting bills at cost, which means the AI provider account, its data settings and its terms sit with the client.
A project starts with a free 30-minute scope call on Google Meet. A blueprint of about a week, credited to the build, sets out a written plan, a clickable prototype, the monthly running cost, a fixed price and the payback maths. The build takes 2 to 6 weeks, with a demo of working software every week. Yarigai's guarantee reads "If the build isn't profitable for you, we won't build it."
Common questions
Can an AI agent be hacked through an email?
Yes. An email can carry hidden instructions that the agent reads as commands, which OWASP calls indirect prompt injection. OWASP's own example shows a crafted email making an inbox assistant search for sensitive data and forward it. Read-only access and human approval for sending stop that attack from doing damage.
Should I give an AI agent access to my business bank account?
Not directly. Give it read-only transaction data through the accounting software, and keep a person approving every payment and every change to payee details. Never share the online banking login with an agent or the agency that builds it.
Does connecting Claude or ChatGPT to Gmail let them train on my emails?
Not on business plans by default. Anthropic says "we do not train our models on your Gmail, Drive, or Calendar connector data". OpenAI lists "No training on your business data by default" for ChatGPT Business, while its personal plans train unless the user opts out.
Do I need a DPIA before connecting an AI agent to customer data?
Usually, yes. The ICO requires a DPIA where processing is likely to result in high risk, and lists innovative technology, including AI, as a factor when combined with other criteria. Doing one also forces the business to write down what data the agent sees and why.
Can any product stop prompt injection completely?
No. The NCSC says there is a good chance prompt injection will never be properly mitigated, and tells buyers to beware any vendor that claims it can stop it. Choose suppliers that explain how they limit the damage.
Is an AI agent safer than a person with the same access?
Not by default. The NCSC says language models do not separate instructions from data, so any email the agent reads can try to redirect it. Give the agent less access than a staff member in the same role, and add hard limits and logs.
Sources
Checked on or before 7 November 2026. Prices change, so check the live page before you decide.
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project, checked 7 November 2026.
- LLM06:2025 Excessive Agency, OWASP Gen AI Security Project, checked 7 November 2026.
- Prompt injection is not SQL injection (it may be worse), National Cyber Security Centre, published 8 December 2025.
- Guidelines for secure AI system development, National Cyber Security Centre, published 27 November 2023.
- Guidance on AI and data protection, Information Commissioner's Office, last updated 15 March 2023, checked 7 November 2026.
- When do we need to do a DPIA?, Information Commissioner's Office, checked 7 November 2026.
- Business data privacy, security, and compliance, OpenAI, checked 7 November 2026.
- Data controls in the OpenAI platform, OpenAI API docs, checked 7 November 2026.
- API and data retention, Anthropic, checked 7 November 2026.
- Is my data used for model training?, Anthropic Privacy Center, dated 18 August 2026, checked 7 November 2026.
- Use Google Workspace connectors, Claude Help Center, checked 7 November 2026.
- Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, Microsoft Learn, checked 7 November 2026.
Keep reading
ChatGPT Business, Claude Team or Microsoft 365 Copilot: which should a small business buy?
ChatGPT Business costs £15 a seat a month in the UK, Claude Team £18 with VAT and Microsoft 365 Copilot £16.10 plus VAT. Here is what each includes.
Read moreAI agent or automation: what's the difference and which do you need?
An automation runs fixed steps and costs from £1,500 to build in the UK in 2026. An AI agent chooses its own steps and starts from £6,500. Here is how to choose.
Read moreWho can build an AI agent for my business?
Five routes to an AI agent in 2026, from a £127 Fiverr gig to an £8,000 agency build or an £87,500 hire, compared on cost, ownership and who fixes it.
Read moreHow to choose an AI agency
The three kinds of AI agency, ten questions to ask before you sign, the red flags and what a good project timeline looks like.
Read moreWant an agent with a person in the loop?
Book a free 30-minute scope call. If the build isn't profitable for you, we won't build it.