Loading articles…
Field notes for building a business that can move without you.
We write from the intersection of operating systems, software, sales, marketing, and leadership—for owners building a more capable company.
Announcement
Give your AI a mailroom, not the keys to your inbox
Connecting ChatGPT to your inbox is fine for an errand. Running a business on it is different. Here's why Sapience works from a mailroom instead: private, filed, and with receipts.
- Author
Alexander Ford- Published
- Reading time
- 9 min read
Contents
In brief
- Connecting ChatGPT or Claude to your inbox is genuinely useful, and both companies have done serious work to make it safer. For a quick errand, it's a fine way to work.
- Running a business on it is different. Every email in your inbox was written by someone else, and an AI that reads your mail can be steered by what it reads. The companies that build these models say so themselves.
- So we didn't give Sapience the keys to your inbox. We built it a mailroom: a private copy of your mail kept current within seconds, emails filed to the right client exactly as they were sent, shared inboxes turned into tickets under rules you can see, and one outgoing desk that keeps receipts.
- The model can still be fooled. The difference is what the structure around it lets a fooled model do.
The question owners keep asking
"Can't I just connect ChatGPT to my email?"
You can, and for a lot of things it works well. Ask it to find last month's quote from your supplier, summarize a long thread, or draft a reply, and it will. Both ChatGPT and Claude can now send email for you as well. Claude asks for your approval before each send by default.[1] ChatGPT lets you choose how much it may do without asking, and it labels the most permissive setting as carrying "elevated risk."[2]
That's careful work, and we use these tools ourselves. But there's a difference between asking an assistant to run an errand in your inbox and building your business around it. The first is like lending someone your keys for an afternoon. The second is deciding how mail moves through your company every day.
For that, a business has needed the same thing for a hundred years: a mailroom.
Every letter in your inbox was written by someone else
Here's the part that's easy to miss. Your inbox feels private, but almost everything in it was written by other people: clients, vendors, newsletters, strangers. When an AI reads your mail, it reads their words too. And an AI can't always tell the difference between information it's reading and instructions it should follow.
Security researchers call this prompt injection: hiding instructions in content an AI will read. It isn't hypothetical. In 2025, Microsoft fixed a critical flaw in Microsoft 365 Copilot where a single crafted email could make the assistant leak information to an outsider, with no click from the victim.[3] OpenAI has written about a 2025 attack in which a deceptive email got ChatGPT to hand over private information in half of the test runs.[4]
Simon Willison, a widely read researcher in this field, explains the danger as three ingredients: access to your private data, exposure to content written by strangers, and the ability to communicate outward.[5] An assistant that can read and send your email has all three.
The model companies are making real progress. Anthropic now reports that attacks on its newest models in its browser tests rarely succeed, and it also says plainly that "prompt injection remains a moving target."[6] We agree with them on both counts. That's why we don't rely on the model alone. The safer question is what the system around the model allows, whether or not the model gets fooled.
A good office already solved this
Think about how mail works in a well-run office.
Letters arrive at one place. Someone sorts them and files each one with the right client. Personal mail goes only to the person it's addressed to. Mail for the front desk gets logged and handed to whoever is responsible. Anything going out leaves from one desk, gets checked, and gets a receipt.
None of that is about distrusting the staff. It's about structure: everyone can do their job without anyone needing keys to everything.
That's what we built for Sapience, the assistant inside Telos.
What the mailroom looks like in Telos
A private copy of your mail, current within seconds
When you sign in to Telos with Microsoft 365 or Google Workspace, Telos keeps a private copy of your last 12 months of mail. New mail arrives in the copy within seconds, including what you send from Outlook or Gmail. Move or delete a message in your mailbox and the copy follows. Drafts, Junk, Deleted Items and Outbox are left out, so Sapience works from the mail you actually kept.
Only you, and Sapience acting for you, can read it. Not your administrator, not the workspace owner, and not anyone else's Sapience. Even our own support team's tools are blocked from reading it. Turn Mail Sync off and your copy is deleted within 24 hours.
Mail gets filed exactly as it was sent
Ask Sapience to find the email from Jordan about the renewal, or to show the whole thread with a client and say where it stands. It searches by meaning and by people, and follows a conversation through every reply.
When you want an email on a client's record, Sapience files it exactly as it was sent: the original sender, recipients, date and full text. It can't rewrite an email in its own words or edit one after it's filed, so your timeline is a record you can rely on. When someone replies to an email you sent from Telos, the reply lands on the same record. A bounce gets marked on the original.
Strangers' pictures don't load until you say so
Many emails load pictures from the sender's website, and some of those pictures exist only to tell the sender you opened the message. Microsoft blocks them by default in classic Outlook for exactly that reason.[7] Telos does the same: images from outside websites stay blocked until you choose Show images on that email. Pictures sent inside the email, like a logo in a signature, still show.
The shared inbox becomes work with an owner
Mail sent to addresses like support@ or info@ becomes tickets in Telos, with the type and assignee you choose. Replies continue the same ticket, and a retry never creates a duplicate. What becomes a ticket is decided by filters you can see and change: automatic replies, bounces, senders and domains you never want, and senders you always want. Flood protection holds a burst from one sender for your attention. An activity list shows what happened to every email, so nothing gets filtered out without a trace.
One outgoing desk that keeps receipts
Everything Sapience sends goes through the same desk. It shows you each message before it goes, with a short undo window. For bigger jobs, your approval counts only for the version you actually saw. Each message is sent exactly once, and Telos records what happened. Sapience can't say an email went out when it didn't. We wrote about this desk in detail in Your AI should draft the follow-up. You should decide what gets sent.
Compare that with an honest line from OpenAI's own Outlook guide: "Check Outlook before repeating a send, move, or other email action."[8] That's sensible advice for a chat tool. A business shouldn't have to do that checking itself.
What this means for your business
- Your assistant knows what you know. The reply you sent from your phone five minutes ago is already in the copy, so Sapience isn't working from yesterday's inbox.
- Your client records stay true. Emails on a timeline are the real messages, and replies find their way back to the right client.
- Your team's mail stays theirs. Owners and administrators manage the workspace, not each other's inboxes.
- Shared mail gets an owner. Support requests become assigned tickets, under rules you can read.
- Mistakes stay small. If a cleverly written email ever misleads Sapience, the structure still decides what it can do: it can read and draft, and nothing leaves without coming past you.
What it doesn't do
We'd rather be plain about the limits.
The mailroom doesn't make Sapience immune to tricky email. No assistant is, and nobody serious claims otherwise. What it does is limit what a mistake can cost. Research on securing AI agents points the same way: build the system so that untrusted content can't trigger consequential actions on its own, and have a person review what matters.[9]
Mail Sync works with Microsoft 365 and Google Workspace work accounts. It copies the last 12 months; older mail stays in your mailbox. Attachments are listed by name and size and open from your mailbox when you need them.
We run our own company on this same system every day. When we find something that needs to work better, we fix it there first.
Why we build it this way
It would have been easier to hand an AI the keys and call it automation. Instead, we built the dull, dependable parts a good office has always had: a sorting table, a filing cabinet, a front desk and an outgoing tray with receipts. Then we put a very capable assistant to work inside them.
Your inbox holds your relationships. The assistant should help you keep them, inside a structure you can see and trust.
If you're a Telos client, it's already on. Ask Sapience about your email, and see Let Sapience work with your email and Set up shared mailboxes for the details. If you'd like a system like this in your business, see what Accelerator OS includes.
[1] Anthropic, Claude Help Center, "Use Google Workspace connectors": "By default, Claude asks for your approval before each of these actions." support.claude.com
[2] OpenAI Help Center, "Managing app permissions in ChatGPT": "This option carries elevated risk." help.openai.com
[3] Microsoft, CVE-2025-32711, "M365 Copilot Information Disclosure Vulnerability," published 11 June 2025 and rated critical (9.3). cve.org record. The attack chain is described in Reddy and Gujral, "EchoLeak," which reports that Microsoft fixed it before public disclosure. arxiv.org/abs/2509.10540
[4] OpenAI, "Designing AI agents to resist prompt injection," 11 March 2026. The 50% figure is a specific 2025 attack reported by researchers, not a general rate. openai.com
[5] Simon Willison, "The lethal trifecta for AI agents: private data, untrusted content, and external communication," 16 June 2025. simonwillison.net
[6] Anthropic, "Claude in Chrome is generally available," 26 August 2026. claude.com
[7] Microsoft Support, "Block or unblock automatic picture downloads in classic Outlook email messages": pictures are blocked to avoid "invisible images that can tell a sender you've read the email." support.microsoft.com
[8] OpenAI Help Center, "Outlook Email and Calendar apps in ChatGPT." help.openai.com
[9] Beurer-Kellner et al., "Design Patterns for Securing LLM Agents against Prompt Injections," 2025: "The user is asked to review and confirm any consequential action." arxiv.org/abs/2506.08837
