Your email is two things that can't coexist with AI

Your email is your identity. Login with Google is the multi-factor auth we trust to unlock our privileged services, and for most services, access to your email is how you prove you are who you say you are.

But your email is also the center and start of all the tasks you have to do. Products like Superhuman and Fyxer are exploding in popularity right now, and startups like Lobby are reinventing the UI of email to support AI task management.

If you want to give AI the power to get your work done, you need to give it your email. But if you want to protect your email-based identity from being misused, you want to be careful about who can be you. The more AI tools you try, the more your risk surface spreads.

The Vercel compromise this week is what that collision looks like in practice. Attackers pulled sensitive secrets out of Vercel's internal systems using a compromised third-party Google OAuth credential. We've had this wild west of trying out AI tools while a lot of security people have been raising alarms for quite a long time that this isn't safe. I recently talked to an IT lead at a Fortune 500 who told me he disapproves basically no tool requests, because in the end his job is to make it happen for the team.

Most of the AI security conversation has been about prompt injection, where the agent follows malicious instructions it finds inside an email. That's a real risk, but the Vercel attack wasn't prompt injection. It was a classic credential leak that became catastrophic because of how much power email-based OAuth carries. That's the failure mode we should be more worried about.

So here are some techniques you can use to get the best of both worlds while we figure this out.

Split your identity email from your work email. Participate in the world from one; use another for your logins. Give your AI access to your marketing email, not your login codes. It doesn't fix the fundamental risk, but it narrows the blast radius when an agent or a vendor misbehaves. Google has made multiple accounts work very well, and auto-forward rules in Gmail can bridge the gap without forwarding 2FA codes.

Give your agent its own email. We do this at Valet. We like using agentmail.to. The idea is to start fresh with a sandbox you trust, where the emails are only for the agents. Don't put agents in your core inbox at all. Forward what they need, and have the act of forwarding be part of your trigger sequence to accomplish work.

Consider enabling enterprise OAuth controls. The cost is that your team slows down. They can't try as many things without asking. Controls give you a sense of control, but unless you're willing to stop experimentation and say no to new tools, they likely don't change the risk surface.

The deeper problem is scope. OAuth's scopes in practice are too broad for AI. An agent doesn't need to read/write over your entire inbox, it needs to read/write over the task at hand. There's no per-resource scope in OAuth today. Think about how Google Docs works: you share one document at a time with one collaborator, and that's it. Agents need the same shape of access over your email, one class of things at a time, and we need to make that programmatic.

Have fun out there. Stay safe.