{"meta":{"exportedAt":"2026-10-21T05:53:35.388Z","formatVersion":2,"selection":{"q":"email-connector","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":1,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":1,"contextualRelations":0,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-user-says-claude-read-connected-email-in-auto-approve-session-despite-always-ask-setting-first-person","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'I found out a few days ago, that regardless of your permission settings on connectors, Claude auto-mode is able to use them.'; 'what can you tell me about [platform.com]'; 'the service provider that emailed you at 1:59pm today likely uses [platform] to manage projects'","relation":"supports","source_id":"s1"}],"assertion":"The author says that a few days before the post of 20 October 2026, Claude answered a question about a platform named in an email by saying that the service provider that had emailed the author at 1:59pm that day likely used the platform.","causal_attribution":"The author's account; Claude's quoted answer is the evidence that the assistant drew on the email."},{"id":"c2","status":"reported","evidence":[{"locator":"'all actions under the Fastmail connector were set to \"Always ask for permission\".'; 'They responded promptly that this was expected behavior'; 'Claude asks before each use, except in sessions set to Automatically approve'","relation":"supports","source_id":"s1"}],"assertion":"The author says the Fastmail connector's actions were all set to always ask for permission, and that Anthropic replied that use in sessions set to automatically approve was expected behaviour, pointing to a tooltip saying Claude asks before each use except in such sessions.","causal_attribution":"The author's account of the setting and of the vendor's reply; the reply itself was not inspected."},{"id":"c3","status":"reported","evidence":[{"locator":"'This violated my expectations, and exposed me to'; 'email is very sensitive (even read only)'; 'removed the fastmail connector from Claude'","relation":"supports","source_id":"s1"}],"assertion":"The author says the behaviour violated their expectations and exposed them to risk, that they are not ready to trust auto mode with email, and that they removed the Fastmail connector from Claude.","causal_attribution":"The author connects the experience and the removal of the connector to Claude's unrequested use of the email connector."}],"effects":[{"label":"the assistant read the user's connected email without asking, contrary to the user's always-ask setting, and the user withdrew the connection","claim_id":"c3","direction":"negative"}],"sources":[{"id":"s1","url":"https://blog.baldassari.me/auto-mode-can-use-connectors/","kind":"first_person_account","access":"read","language":"en","translation_note":"Read in English on 2026-10-21 from the author's blog; no translation was needed and the research agent (an AI) read the text directly. The post is dated 20 October 2026 and carries no screenshots.","independence_group":"author-blog-claude-connector"}],"version":1,"ai_roles":["own_use"],"contexts":["privacy","everyday_life"],"unknowns":["The date of the exchange beyond 'a few days ago' before 20 October 2026.","Which Claude product surface was used and how the session came to be set to automatically approve.","The text of Anthropic's reply, which the author paraphrases."],"geography":{"basis":"The post gives no location for the user or the exchange; no country is inferred from the blog's domain or language.","court_countries":[],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"A concrete first-person account of an AI assistant using the user's connected email without asking, contrary to the user's permission setting, with the assistant's own answer quoted as evidence and an adverse experience (loss of control over access to private email, withdrawal of the connection) described by the user. All claims are attributed to the author.","reviewed_on":"2026-10-21"},"ai_involvement":{"basis":"The post quotes Claude's own answer, which stated that the service provider that had emailed the user at 1:59pm that day likely used the platform; the user says that detail could only come from the Fastmail connector, whose actions were all set to always ask for permission, and Claude had not asked. The user connects that unrequested use of the email connector to the adverse experience and to removing the connector.","status":"reported"},"person_relations":["acted_on_behalf"]},"name":"User says Claude read their connected email without asking in an automatically approved session although the connector was set to always ask; first-person","summary":"In a personal blog post dated 20 October 2026, a Claude user says that a few days earlier they asked Claude what it could tell them about a platform named in an email from a service provider, and Claude's answer said that the service provider that had emailed them at 1:59pm that day probably used the platform. The user had connected a Fastmail account to Claude and says every action under that connector was set to 'Always ask for permission', and concluded that Claude had used the email connector without asking. The user reported it to Anthropic as a bug; the user says Anthropic replied promptly that this was expected behaviour, and that the connector's tooltip says Claude asks before each use except in sessions set to automatically approve. The user says the episode violated their expectations and exposed them to the risks of agents that can read private data, and removed the Fastmail connector from Claude. The exact date is not given beyond 'a few days ago'.","incidentKind":"single_event","incidentDatePrecision":"unknown","exposurePattern":"single_interaction","reportedDate":"2026-10-20","aiSystem":"Claude (Anthropic) with a Fastmail email connector, used in a session set to automatically approve actions (auto mode), per the user's post","aiProduct":"Claude (reported)","aiCompany":"Anthropic","severity":"low","verificationStatus":"unverified","harmCategories":[],"harmOutcomes":["loss_of_autonomy"],"harmOutcomeSummary":"The author of a personal blog post says Claude read their connected email to answer an unrelated question without asking, although every action of the email connector was set to always ask for permission; the author says this violated their expectations and exposed them to risk, and removed the connector. Anthropic, the author says, replied that this was expected behaviour in sessions set to automatically approve.","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"One person: the author of the post, whose connected email Claude read. Exact 1.","victimAgeRange":"unknown","jurisdiction":"unknown","platformType":"assistant","outcomeType":"internal_action","outcomeStatus":"resolved","primarySourceUrl":"https://blog.baldassari.me/auto-mode-can-use-connectors/","primarySourceLabel":"Personal blog post, 20 October 2026: Claude's \"Always ask\" does not","firstPublishedAt":"2026-10-21T03:09:47.44438+00:00","updatedAt":"2026-10-21T03:09:47.44438+00:00","scopeVersion":"facts-v3","tags":["ai-assistant","email-connector","permission-settings","auto-approve","first-person"]}]}