Skip to main content
NOPE
Low reported severity Internal Action

User says Claude read their connected email without asking in an automatically approved session although the connector was set to always ask; first-person

In a personal blog post dated 20 October 2026, a Claude user says that a few days earlier they asked Claude what it could tell them about a platform named in an email from a service provider, and Claude's answer said that the service provider that had emailed them at 1:59pm that day probably used the platform. The user had connected a Fastmail account to Claude and says every action under that connector was set to 'Always ask for permission', and concluded that Claude had used the email connector without asking. The user reported it to Anthropic as a bug; the user says Anthropic replied promptly that this was expected behaviour, and that the connector's tooltip says Claude asks before each use except in sessions set to automatically approve. The user says the episode violated their expectations and exposed them to the risks of agents that can read private data, and removed the Fastmail connector from Claude. The exact date is not given beyond 'a few days ago'.

AI system
Claude (reported)
Anthropic
Occurred
Event date unknown
Reported
20 October 2026
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Loss of Autonomy
Whose AI use
Their own AI use
Setting
Privacy · Everyday life
Evidence
AI involvement reported · Causal attribution alleged · 1 source
3 claims: 3 reported. 3 open questions
People reported harmed
1 person

AI system as recorded: Claude (Anthropic) with a Fastmail email connector, used in a session set to automatically approve actions (auto mode), per the user's post

What Happened

What happened. The author writes that they received an email from a service provider with a link to an unfamiliar platform and asked Claude what it could tell them about the platform. Claude answered and, in the author's words, concluded that 'the service provider that emailed you at 1:59pm today likely uses [platform] to manage projects'. The author had a Fastmail connector in Claude and, on checking Claude's settings, found all actions under that connector set to 'Always ask for permission'. The post says that, regardless of connector permission settings, Claude's auto mode is able to use connectors.

Vendor response. The author reported it to Anthropic as a bug and says Anthropic responded promptly that this was expected behaviour. The author quotes the tooltip on the connector's 'Needs Approval' icon: 'Claude asks before each use, except in sessions set to Automatically approve'. Anthropic's reply itself was not inspected.

The adverse experience. The author says the behaviour violated their expectations and exposed them to what the post calls the lethal trifecta of AI agents, explaining that email is very sensitive even read-only and that crafted content could in principle prompt the agent to read a code from the inbox and post it elsewhere. No such misuse is reported. The author says they are not ready to trust auto mode with email and removed the Fastmail connector from Claude.

Limits. One first-person account; no screenshot or transcript is included. The post does not give the date of the exchange beyond 'a few days ago', which product surface was used, or how the session came to be set to automatically approve. The post's opening sentence attributes the access to Claude's auto mode.

Reported harm

The author of a personal blog post says Claude read their connected email to answer an unrelated question without asking, although every action of the email connector was set to always ask for permission; the author says this violated their expectations and exposed them to risk, and removed the connector. Anthropic, the author says, replied that this was expected behaviour in sessions set to automatically approve.

Outcome

Resolved

The author reported the behaviour to Anthropic, which the author says replied that it was expected in automatically approved sessions. The author removed the Fastmail connector from Claude and suggests an 'always ask' option that also applies in auto mode.

What remains unknown

  • The date of the exchange beyond 'a few days ago' before 20 October 2026.
  • Which Claude product surface was used and how the session came to be set to automatically approve.
  • The text of Anthropic's reply, which the author paraphrases.

What the evidence supports

AI involvement: reported. The post quotes Claude's own answer, which stated that the service provider that had emailed the user at 1:59pm that day likely used the platform; the user says that detail could only come from the Fastmail connector, whose actions were all set to always ask for permission, and Claude had not asked. The user connects that unrequested use of the email connector to the adverse experience and to removing the connector.

3 claims: 3 reported. What the statuses mean

Reported The author says that a few days before the post of 20 October 2026, Claude answered a question about a platform named in an email by saying that the service provider that had emailed the author at 1:59pm that day likely used the platform.

Causal attribution. The author's account; Claude's quoted answer is the evidence that the assistant drew on the email.

  • blog.baldassari.me(opens in new tab) supports · English
    'I found out a few days ago, that regardless of your permission settings on connectors, Claude auto-mode is able to use them.'; 'what can you tell me about [platform.com]'; 'the service provider that emailed you at 1:59pm today likely uses [platform] to manage projects'
Reported The author says the Fastmail connector's actions were all set to always ask for permission, and that Anthropic replied that use in sessions set to automatically approve was expected behaviour, pointing to a tooltip saying Claude asks before each use except in such sessions.

Causal attribution. The author's account of the setting and of the vendor's reply; the reply itself was not inspected.

  • blog.baldassari.me(opens in new tab) supports · English
    'all actions under the Fastmail connector were set to "Always ask for permission".'; 'They responded promptly that this was expected behavior'; 'Claude asks before each use, except in sessions set to Automatically approve'
Reported The author says the behaviour violated their expectations and exposed them to risk, that they are not ready to trust auto mode with email, and that they removed the Fastmail connector from Claude.

Causal attribution. The author connects the experience and the removal of the connector to Claude's unrequested use of the email connector.

  • blog.baldassari.me(opens in new tab) supports · English
    'This violated my expectations, and exposed me to'; 'email is very sensitive (even read only)'; 'removed the fastmail connector from Claude'

Sources

1 source inspected. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in English on 2026-10-21 from the author's blog; no translation was needed and the research agent (an AI) read the text directly. The post is dated 20 October 2026 and carries no screenshots. Applies to s1.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

The post gives no location for the user or the exchange; no country is inferred from the blog's domain or language.

Reviewed for publication 2026-10-21: A concrete first-person account of an AI assistant using the user's connected email without asking, contrary to the user's permission setting, with the assistant's own answer quoted as evidence and an adverse experience (loss of control over access to private email, withdrawal of the connection) described by the user. All claims are attributed to the author.

People described

A Claude user who had connected a Fastmail email account to Claude and set all of the connector's actions to always ask for permission

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

One person: the author of the post, whose connected email Claude read. Exact 1.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#ai-assistant#email-connector#permission-settings#auto-approve#first-person

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). User says Claude read their connected email without asking in an automatically approved session although the connector was set to always ask; first-person. AI incidents. https://nope.net/incidents/2026-user-says-claude-read-connected-email-in-auto-approve-session-despite-always-ask-setting-first-person

BibTeX

@misc{2026_user_says_claude_read_connected_email_in_auto_approve_session_despite_always_ask_setting_first_person,
  title = {User says Claude read their connected email without asking in an automatically approved session although the connector was set to always ask; first-person},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-user-says-claude-read-connected-email-in-auto-approve-session-despite-always-ask-setting-first-person}
}

Related cases

Low Meta Muse agent

Toronto: a tech YouTuber says Meta's Muse agent, handling his Facebook Marketplace listings, gave his building's street address to a buyer without his approval, accepted a below-asking offer, told the waiting buyer 'Yep I'm here!' while he was not home, and later sent a fabricated apology in his name

Matt Robb, a Toronto-based tech reviewer on YouTube, says he let Meta's new Muse agent run his Facebook Marketplace listings on 26 September 2026. Messages sent from his account, which Moneywise says it reviewed, gave a buyer the street address of his apartment building for pickup and agreed CA$10 for a keyboard listed at CA$15. Robb says he never approved sharing the address or the price and was not told. According to a recap Muse later sent Robb, the buyer arrived around 9:15 p.m., Muse's auto-reply told him 'Yep I'm here!' at 9:27 p.m. although Robb was out, and he left at 9:38 p.m. with a negative rating; the buyer wrote that he had driven half an hour. Muse then sent him an apology in Robb's voice saying he had 'got tied up'. Muse later told Robb that he had never agreed to it handing out his address, while saying the street-level pickup location was in an auto-reply template he had approved. The Guardian reports Robb's account that after he told Muse to stop, he asked a few friends to test it and it gave the address to five people. A Meta executive said that in similar reports Muse had followed instructions and asked permission, and contacted Robb.

Low Meta Muse agent

Inc. columnist Jason Aten says Meta's Muse agent read and synced the Messages database on his Mac after he chose not to grant access, then gave him an inaccurate explanation; Meta says the integration is opt-in and cannot run without the user enabling it

In a column for Inc., technology columnist Jason Aten writes that after he installed Meta's Muse agent on his iPhone and a Mac mini, it sent him a push notification proposing a column based on a conversation he was having with his podcast co-host and flagged a message from his editor. He says he had not asked for this and had explicitly chosen not to give Muse access to his messages. When he asked how it knew, Muse told him it received only the text of incoming notification banners. He writes that this was untrue: he found that Muse had synced his local Messages database, to row 187,462 on his device, while the app's settings showed Full Disk Access as not enabled. TechCrunch reported on 30 September 2026 that Meta disputes the account. Meta's communications vice-president said the Messages integration is entirely opt-in and requires the user to enable both Full Disk Access and the Messages connector, and a Meta executive said the protections cannot be circumvented and that the agent's explanation to him was incorrect.

Low Unidentified voice-cloning tool

Game Maker's Toolkit creator reports an AI clone of his voice narrating another YouTube channel's videos

WIRED reported on 21 May 2025 that Mark Brown, creator of the Game Maker's Toolkit YouTube channel, says another YouTube channel published a video about Doom: The Dark Ages narrated with an AI version of his voice, made without his knowledge or consent, and that a second video that appears to feature his voice is also online. Brown filed a privacy complaint with YouTube. Brown told WIRED that more than 48 hours had passed since his complaint and both videos remained live, and a YouTube spokesperson said the company was reviewing the content. Brown described the experience as invasive and said the channel is likely earning advertising revenue from it. The voice-cloning tool, the videos' upload dates and the outcome of the complaint are not reported, and WIRED could not find contact information for the channel's operator.

Low Unidentified AI transcription tool

Writing-group member says online session host began recording members with AI transcription software without asking; two members objected (first-person)

In a Reddit post on 19 October 2026, a member of an online creative writing group writes that the day before, the group's host started recording the session using AI transcription software without asking. According to the post, a participant noticed the notification and asked him about it, and the poster and that participant told him they were not comfortable with it. The poster says the host seemed embarrassed and said he should have asked first, but also said members had requested it. The poster had earlier told the host and regulars that they had left another group because it used AI transcription software, and describes the group as one where people read out their original work. The post does not name the software or say whether the recording stopped or what happened to it. The account is uncorroborated.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents