Before you start
Four terms carry this lesson. A scope is one permission an app asks for when you sign in, such as read your files. Least privilege means granting only the scopes a job needs. An approval prompt is the moment the AI stops and asks you before it acts. Prompt injection is text that tells the AI to do something, hidden in an email, a web page or a file the AI reads, so the instruction comes from the content and not from you.
Anthropic's engineering post of 25 May 2026 says protection in the model layer will never be 100% effective, so it cannot stand alone. That is why this lesson spends its time on what you control: the account, the permission, the approval and the content you let in.
How an email can steer an AI that has a connector
The OWASP Top 10 for LLM Applications describes this case. A personal assistant gets a mail extension to summarize incoming email, and the extension also includes sending functions. A malicious email uses indirect prompt injection to make the AI search the inbox for sensitive data and forward it to the attacker. OWASP defines indirect injection as an AI accepting input "from external sources, such as websites or files."
OpenAI's API guide gives a second shape. A web page could tell the model to look up a customer in a CRM and put their email address in a URL, which leaks it even though the tool only reads. OpenAI's advice is to run public web queries separately from internal ones.
Both stories have the same middle step. The AI follows an instruction it found in content, using access you gave it for a different job.
An audited connector isn't the same as audited data.
Seven checks before you connect an app
Run them in this order. The box below is a note you can copy for each link you make.
App:
Account I link (work or personal):
Scopes it asks for (read or modify):
Who runs it, and is it in the vendor's directory:
Approval setting: ask every time
Data in it I would not paste into a chat:
Date I will review this link again:- Choose the account. OpenAI's walkthrough says to check the account and the access being requested before you connect. Link the account the job needs, not the one that holds everything.
- Read the scopes. Names such as
drive.readonlyandMail.Readsay read, whilegmail.modifysays modify. The first lesson has the table. - Prefer the narrowest tool. OWASP says to offer the AI only the extensions it needs, with only the functions they need, and to avoid open-ended ones. A mail summarizer has no use for a send button.
- Ask who reviewed it. Anthropic says its connector directory involves ongoing review and that anything outside it should be treated as untrusted. OpenAI says remote servers it has not verified can access, send and receive data, and to prefer official servers run by the service provider.
- Set approvals to ask every time. OpenAI's changelog says ChatGPT users can choose when connected apps ask for permission: always, before making changes, or only before important changes. Start with always. Anthropic says that for Gmail and Drive, you control when Claude needs your approval.
- Keep untrusted content apart. OpenAI's API guide runs a public web search in one request and an internal lookup in a second. In a chat app, the same idea is Mindket's suggestion: browse the web in one chat and work on your mailbox in another.
- Read before you approve. OWASP asks for human approval of high-risk actions, and that only helps when the human reads the request.
Why asking every time is not enough on its own
Anthropic's post reports what happened when Claude Code asked permission for each action. Users approved about 93% of the prompts. The post's reading is that the more approvals a user sees, the less attention they pay to each. Anthropic found that an operating-system sandbox cut permission prompts by 84%, which favors firm limits over more questions.
The same post cites Gray Swan's benchmark, in which Claude Opus 4.7 held attack success to roughly 0.1% on single attempts and around 5 to 6% after 100 adaptive attempts. A low rate is still a rate. Hold the line with narrow access, and treat the prompt as the last check.
93%
of Claude Code permission prompts that users approved, from Anthropic's telemetry
Source: Anthropic: How we contain Claude (read November 6, 2026)
84%
fewer permission prompts after an operating-system sandbox was added to Claude Code
Source: Anthropic: How we contain Claude (read November 6, 2026)
0.1%
attack success on single attempts against Claude Opus 4.7 in Gray Swan's benchmark, as Anthropic reports it
Source: Anthropic: How we contain Claude (read November 6, 2026)
5 to 6%
attack success against the same model after 100 adaptive attempts
Source: Anthropic: How we contain Claude (read November 6, 2026)
What each risk looks like and what the sources say reduces it
| Risk | What it looks like | What reduces it |
|---|---|---|
| Hidden instructions in content | A web page or file the AI reads tells it to leak the conversation through an image link | Mark external content as untrusted and keep it apart from your own data (OWASP LLM01) |
| Too much access | A mail summarizer that can also send mail | Read-only scopes, fewer functions, approval of each send (OWASP LLM06) |
| Approval fatigue | Users see so many prompts that they pay each one less attention | Narrow permissions and firm limits instead of more questions (Anthropic) |
| A server that changes later | A hosted server can change behavior at any point after you approved it | Prefer the directory and official servers, test on fake data first (Anthropic, OpenAI) |
| A leak through a public query | A web page steers a lookup of internal data | Run public web queries apart from internal ones (OpenAI) |
On a work account, ask first
OpenAI's page on connecting a plugin says account and workspace policies apply to adding and using custom MCP servers in ChatGPT. Its changelog says users and admins can both set the permission prompts of connected apps. For Claude Desktop, Anthropic's engineering post lists controls an administrator can use for extensions: Group Policy on Windows and MDM on macOS, pre-installed approved extensions, blocklists for extensions or publishers, and a private directory.
You do not need to know those settings by name. Put three questions to your IT team first: may I add a custom server, what is the approval setting, and which extensions are allowed.
Common mistakes
- Approving by reflex. Anthropic's telemetry on Claude Code found users approved roughly 93% of permission prompts. Those are developer prompts, not Gmail ones, but the point holds: a prompt protects you only on the days you read it.
- Reading a reviewed connector as reviewed content. A clean connector can still load a poisoned document.
- Giving a summarizer the right to send. If the job is to read, the scope should say read.
- Mixing web browsing with mailbox work in one chat. A page can carry instructions that the AI then follows with access to your mail.
- Treating a refusal by the model as the defense. The model layer is one defense among several.
Try it yourself
- Fill in the checklist for one app you already linked, and change one setting because of what it shows.
- Switch approvals to ask every time on that app and send one request that needs a write.
- Skim ten recent emails and mark any line that gives an instruction to whoever reads it. Then name the linked apps that could carry that instruction out.
- Remove one link you no longer use.
Next course: AI images and video
Connectors let an AI work with your mail and files. The next course turns to pictures and clips, and its first lesson, how to write image prompts, starts there.
Check yourself
A mail summarizer also has send functions, and a malicious email tells it to forward your inbox. What does OWASP say could avoid this?
Show answer
B. Limit it to read-only mail functions and a read-only OAuth scope OWASP's scenario lists an extension that only reads mail, a read-only OAuth scope, and a person who reviews and sends every drafted email.
About what share of Claude Code permission prompts did users approve, in Anthropic's telemetry?
Show answer
C. About 93% Anthropic's post of 25 May 2026 says users approved roughly 93% of permission prompts.
What does OpenAI advise for a public web query and an internal CRM query?
Show answer
A. Run them separately OpenAI's API guide recommends running public web queries separately from internal CRM queries, because a web page can steer a lookup.
What does "An audited connector isn't the same as audited data" warn about?
Show answer
D. A reviewed connector can still load poisoned content Anthropic's example is a connector that passes checks yet loads a poisoned file into the model's context.
Frequently asked questions
Is it safe to connect Gmail to ChatGPT or Claude?
It is safer when the link is read-only, the account is the one you mean and approvals are on. No setting removes the risk of hidden instructions, so keep the access narrow even then.
How does prompt injection get past a connector?
The connector hands the AI whatever content it fetched. OWASP says hidden instructions work as long as the model parses the content, even when a person cannot see them. Its examples include a page that makes the model leak a conversation through an image link.
Can an AI send email without asking me?
Only when you allow it. Both vendors describe the approval setting as yours, so start with the strictest option and loosen it after you have read a few requests.
What does a read-only connector mean?
It means the permission you grant covers reading and not changing. Scope names such as drive.readonly and Mail.Read say so, and OWASP suggests a read-only OAuth scope for a mail summarizer.
How do I know a connector has been reviewed?
Look for it in the vendor's own directory, and treat a server you found anywhere else as unreviewed. Scopes, approvals and fake data first apply either way.
Sources
- Anthropic: How we contain Claude https://www.anthropic.com/engineering/how-we-contain-claude
- Anthropic: Desktop Extensions https://www.anthropic.com/engineering/desktop-extensions
- OWASP: LLM01 Prompt Injection https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/blob/main/2_0_vulns/LLM01_PromptInjection.md
- OWASP: LLM06 Excessive Agency https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/blob/main/2_0_vulns/LLM06_ExcessiveAgency.md
- OpenAI: Tools, connectors and MCP (API guide) https://developers.openai.com/api/docs/guides/tools-connectors-mcp
- OpenAI: Plugins security and privacy https://developers.openai.com/plugins/guides/security-privacy.md
- OpenAI: Plugins changelog https://developers.openai.com/plugins/changelog
- OpenAI: Plugins and skills walkthrough https://developers.openai.com/training/walkthroughs/plugins-and-skills
- OpenAI: Connect and test your plugin https://developers.openai.com/plugins/deploy/connect-chatgpt.md
- Claude (@claudeai) on X: Gmail and Drive update https://x.com/claudeai/status/2089806039088517356