OpenAI ships no email product: there is no address you can forward mail to, and the API has no built-in email tool. ChatGPT reaches email only through your own Gmail or Outlook connection. Since June 2026 that connection can genuinely send, not just draft - you can ask ChatGPT to write and send an email from inside a conversation, on the web, on Plus, Pro, Business and Enterprise plans. The Gmail connection uses a single broad scope that covers read and write, and Outlook's includes send and shared-mailbox permissions. What none of it does is run on its own: nothing is triggered by mail arriving, and scheduled tasks deliver in the app and by push rather than by email. An inbox that reads and answers mail unattended is still something you build.
ChatGPT can now actually send the email.
Which is the reason to slow down.
There is no OpenAI email product and no address to forward to. What there is, since mid-2026, is a Gmail and Outlook connection that will draft and send from inside a chat - and that deserves a deliberate setup, not a default one.
The short answer.
| At a glance | |
|---|---|
| Is there an OpenAI email product? | No. There is no address to forward to, no email channel for ChatGPT, and no first-party email tool in the API. |
| Can ChatGPT send email? | Yes, since June 2026. Ask it in a chat and, with Gmail or Outlook connected, it drafts and sends - on the web, for Plus, Pro, Business and Enterprise. |
| Gmail permissions | A single broad scope that covers read and write - effectively everything short of permanent deletion. It is not read-only, whatever older articles say. |
| Outlook permissions | Read, read-write, send, and the shared and delegated equivalents, plus mailbox settings and contacts. Shared mailboxes are supported: list, read, move, and send on behalf of. |
| Is it event-driven? | No. Nothing runs because a message arrived. Scheduled tasks deliver in the app and by push, are capped at one run per hour, and have no webhooks. |
| Admin required | For Gmail, a Google Workspace admin marks the OpenAI OAuth app as trusted. For Outlook, org-wide consent is granted in Microsoft Entra. Write actions are off until an admin enables them. |
| Build-your-own stack | An inbound-mail webhook - Postmark, Mailgun, SendGrid Inbound Parse or Resend - in front of the OpenAI API, replying through the same provider. |
Last reviewed 2026-07-29 View as Markdown
Your options.
Email is where the gap between "the AI helps me with my inbox" and "the AI runs my inbox" is widest. These are the four honest paths.
| Approach | What you get | Where it stops |
|---|---|---|
| The Gmail plugin | ChatGPT searches and reads your Gmail from a conversation, drafts replies, and since mid-2026 can send them. Its single OAuth scope covers read and write alike. | You have to be in ChatGPT and ask. That one scope is broad - there is no read-only variant - so scope it to the right account rather than the busiest one. Sending is web-only at time of writing. |
| The Outlook plugin | The richer of the two. Read, read-write and send, including shared and delegated mailboxes, plus mailbox settings, calendar and contacts. | Also invoked by you, in ChatGPT. Its published capability list is out of date and omits sending even though the permission is right there, so trust the permissions, not the marketing bullets. |
| Scheduled tasks | The closest thing to unattended email work: a recurring task that can send mail through your connected Gmail or Outlook. | Delivery is in-app and by push, not by email. Capped at one run per hour with a small number of active tasks per plan, and there are no webhooks. It is a timer, not a trigger. |
| An inbound-mail bot you build | The only way to get an address that reads and answers on its own. An inbound provider posts each message to your webhook, you call the OpenAI API, and you reply through the same provider. | You own deliverability, SPF, DKIM and DMARC, threading headers, quoted-text stripping, idempotency and loop protection. Each provider has its own trap, and the model is the easy part. |
| An AI teammate with its own inbox | A product that already has an address you can email and reply to, with deliverability and threading solved. Beagle answers its own inbox and behaves the same way there as in Slack. | It is a teammate you email, not a filter over your personal mailbox. If you want triage inside your own inbox, a plugin or an add-in is the closer fit. |
Step by step.
Steps one to five connect ChatGPT to your mail safely. Steps six and seven cover the build you need if you actually want an inbox that answers itself.
01 Decide whether you want help or autonomy
Helping you write and send a specific email is a plugin. An inbox that triages and answers overnight is a build. Everything else follows from which of those you promised, and no first-party OpenAI product does the second one.
02 Get the admin trust in place
For Gmail, a Google Workspace administrator marks the OpenAI OAuth app as trusted in the Google admin console. For Outlook, an administrator grants org-wide consent through Microsoft Entra from the ChatGPT admin app settings. Neither is self-serve in a managed tenant.
WhereGoogle admin console app access control, or the Entra consent flow
03 Look at the actual permissions, not the feature list
Gmail's connection uses one broad scope covering read and write - there is no read-only option. Outlook's includes send and the shared-mailbox equivalents. Outlook's published capability bullets omit sending even though the permission is granted, so read the permissions before you decide what this can do.
04 Turn write actions on separately, and late
Read access and write actions are different switches, and write actions are off until an admin enables them. Connect read-only first, let people use it for a week, then decide whether sending is worth it. On Enterprise and Edu, apps are off by default anyway.
05 Keep the confirmation prompt on
The default behaviour asks before important actions, and sending or editing email on your behalf is the first example OpenAI gives of an important action. Leaving that default alone is the single highest-value setting on this page. Do not set it to never ask because the prompts are annoying.
06 If you want an inbox that answers itself, put a webhook in front
Point a dedicated address at an inbound-mail provider and have it post each message to your endpoint. Verify the signature, strip the quoted history, key on the Message-ID for idempotency, enqueue the work, call the model, and reply through the same provider.
ThreadingSet In-Reply-To and References on the reply or every answer starts a new thread
07 Read your provider's specific trap before you pick one
They differ more than the marketing suggests. Postmark returns clean JSON and strips quoted replies for you, but inbound counts against your send quota and needs a paid tier. Mailgun is cheapest at volume and gives you raw MIME if you ask for it, but every route evaluates unless you stop it. SendGrid needs an authenticated subdomain and its webhook will not follow redirects. Resend's webhook carries metadata only, so you fetch the body separately.
What trips people up.
Email is the one channel where a small misconfiguration becomes a message a customer should never have received.
It can send, which changes the risk profile
Most guidance still says ChatGPT can only draft. That stopped being true in June 2026. Anything you wrote in a rollout plan on the assumption that a human always pastes and sends needs revisiting, because the human step is now optional.
The Gmail scope has no read-only setting
The Gmail connection asks for one broad permission covering read and write together. You cannot connect it in a read-only mode. If you want a lower-risk pilot, scope it to a single low-stakes mailbox rather than assuming a permission toggle exists.
Nothing here is triggered by mail arriving
Plugins are invoked by you. Scheduled tasks are timers, capped at about one run an hour, delivering in-app and by push rather than by email, with no webhooks. Every "AI that handled my inbox overnight" story is a build or a different vendor's product.
Prompt injection is not theoretical in email
OpenAI's own worked example of an attack is an agent being tricked into pulling a password-reset code out of Gmail and leaking it. Their guidance is to avoid vague open-ended instructions like "check my email and handle everything". Mail is the one channel where a stranger writes directly into your model's context.
Residency stops at the connection
OpenAI's data-residency commitments cover its own storage up to the point a query reaches a connected app. Beyond that boundary the connected service's own residency and retention rules apply. Say that out loud before a compliance team assumes otherwise.
Quoted history quietly multiplies your bill
In a build-your-own setup, naive parsing feeds the entire quoted chain back to the model on every reply. Ten messages in, you are paying to re-read the same conversation ten times and getting worse answers for it. Strip the quotes on the way in.
Auto-reply loops are the classic first outage
A bot that replies to an out-of-office will talk to it forever, at your expense, from your domain. Check the Auto-Submitted and Precedence headers, rate-limit per sender, send from a dedicated subdomain with SPF, DKIM and DMARC aligned, and keep a kill switch within reach.
The moment an AI can send mail on your behalf, the interesting question stops being what it can write and becomes what it read first.
Or skip the build.
Beagle takes the other side of the problem. Rather than sitting inside your mailbox, it has one: you email it like a colleague, it does the work across your stack, and it still waits for a human before anything reaches a customer.
It has an address, and it answers it
Away from Slack, email Beagle the way you would email a teammate. Deliverability, threading and the reply chain are already solved, so there is no webhook for you to run and no provider trap to research.
The reply comes from real records
Beagle pulls from the CRM, the tracker, the docs and the inbox before it answers, and shows what it used. It is not writing from the thread alone.
It picks work up on a schedule too
The Monday summary, the follow-up nobody sent, the invoice going unpaid. Beagle runs recurring jobs rather than waiting for a prompt.
Client-facing sends wait for approval
Anything leaving the company arrives drafted, in your DMs or your inbox, for you to approve. The one place an unattended send would be unforgivable is the one place Beagle will not do it.
Plugged into your stack.
OAuth in, every read scoped to the teammate who asked.
Common questions.
Can ChatGPT send emails for me?
Yes, since June 2026. With Gmail or Outlook connected you can ask ChatGPT in a conversation to draft and send an email, and it will. It is available on the web for Plus, Pro, Business and Enterprise plans. Write actions are off until an admin enables them, and the default runtime setting asks you to confirm before an important action such as sending mail.
Is there an OpenAI email address I can forward mail to?
No. OpenAI ships no email product - there is no address to forward to, email is not one of ChatGPT's messaging channels, and the API has no first-party email tool. ChatGPT reaches email only through your own Gmail or Outlook connection.
Can ChatGPT handle my inbox automatically?
Not with anything OpenAI ships today. Plugins are invoked by a person, and nothing is triggered by a message arriving. Scheduled tasks are timers rather than triggers: they are capped at about one run an hour, deliver in the app and by push rather than by email, and have no webhooks. An inbox that reads and answers unattended is something you build with an inbound-mail provider in front of the API.
What permissions does the ChatGPT Gmail connection ask for?
A single broad scope covering read and write - effectively everything except permanent deletion. There is no read-only variant, so a claim that the Gmail connection is read-only is out of date. Outlook's permissions are more granular and include send plus shared and delegated mailbox access, mailbox settings and contacts.
What does our IT admin have to do?
For Gmail, a Google Workspace administrator marks the OpenAI OAuth app as trusted in the Google admin console. For Outlook, an administrator grants org-wide consent in Microsoft Entra from the ChatGPT admin app settings. Separately, write actions are disabled until an admin enables them, and on Enterprise and Edu plans apps are off by default entirely.
Is it safe to connect an AI to a work inbox?
Email is the highest-risk channel to automate, because an external sender writes directly into the model's context. OpenAI's own worked example of an attack is an agent tricked into pulling a password-reset code from Gmail. Keep the confirmation prompt on for sending, avoid open-ended instructions like "handle my inbox", scope the connection to one mailbox rather than a whole tenant, and prefer drafts over unattended sends for anything customer-facing.
