Is it safe to connect Claude or ChatGPT to our email and files?

What a connector is

A connector links an AI tool to another system, such as your mailbox, calendar or file store. Many use a standard called the Model Context Protocol, or MCP. The MCP project publishes its specification in dated revisions, and the latest we read is 2026-07-28.

The point is that the AI can look things up in your own data, rather than you pasting it in. The same link can also let it act: send, move, edit or delete, if the permissions allow.

What can go wrong

The first risk is access that is too wide. The MCP security guidance warns against broad permissions granted up front, because a stolen or misused token then reaches everything. It recommends starting with a minimal set and adding more only when needed.

The second is hidden instructions. Anthropic's help page for custom connectors warns that malicious servers may hide instructions that try to make Claude act in ways you did not intend. This is called prompt injection. The UK National Cyber Security Centre has also written about it, in a blog titled 'Prompt injection is not SQL injection (it may be worse)'.

The third is the connector itself. Anthropic states that custom connectors are not verified by Anthropic, and that server developers can change tool behaviour without warning.

How the vendors let you control it

On Claude, Anthropic says custom connectors work on Free, Pro, Max, Team and Enterprise plans. On Team, only owners can add a connector for the organisation. Each person then connects and enables it for themselves, and Claude reaches only what that person can reach, unless the connector uses a shared key. Users can switch off tools they do not need, and Anthropic advises choosing 'Allow always' only for servers and tools you trust.

On ChatGPT, OpenAI documents connectors and a developer mode for MCP. We could not retrieve that help page on 3 November 2026, so we make no claim here about its plan limits or admin controls. Check it before you switch anything on.

A safe way to start

Pick one use, such as searching a shared folder of policies. Start with read-only access. Switch off any tool that writes, sends or deletes.

Use an approved business plan, and have the account owner add the connector, not each person. Connect to a limited folder or mailbox, not the whole drive.

Keep a human in the loop. Read the approval prompts. Do not allow actions without approval until you have watched the tool work for a few weeks.

Check what the AI can read from outside. An inbox full of unknown senders is the most likely route for hidden instructions, so avoid giving write or send powers on that mailbox.

Write down what is connected, who approved it and the date. Review it every quarter.

What to leave until later

Leave sending email, deleting files and payment systems for later. Leave anything run by a server you cannot identify. If the connector is a small tool from an unknown developer, ask who maintains it and what it can access before anything else.

Where this leaves you

Connectors can save real time on searching and summarising. Treat each one as a new member of staff with a narrow job: limited access, supervised at first, reviewed often. Before you connect anything, read our guide on putting client data into AI tools.

This is a general guide, not legal advice. If you would like help choosing and setting up a first connector, get in touch through our Contact page.

Sources

Model Context Protocol, 'Security best practices', revision 2026-07-28, modelcontextprotocol.io. Read 3 November 2026.

Anthropic, 'Custom connectors' help article, support.claude.com/en/articles/11175166. Read 3 November 2026. The page shows no date.

NCSC, 'Prompt injection is not SQL injection (it may be worse)', ncsc.gov.uk.