Is ChatGPT Work Safe to Connect to Your Email and Files?
By Ashikur Rahman13 min readQuick answer: ChatGPT Work is safe enough for most people to use with care, but it is not safe to connect to everything and walk away. Work is OpenAI's agent for long, multi-step tasks: it can read connected apps such as email, files and calendars, use a browser, and on the desktop use your local files and apps with permission. OpenAI's own help pages say that connecting an agent to your accounts "creates potential privacy risks, including "prompt injection" attacks," and that its safeguards "don't eliminate all risks." On personal Free, Plus and Pro accounts, data sharing for model training is on by default. Turn that off, connect only what a task needs, approve actions yourself, and keep passwords out of it.
What is ChatGPT Work, and what can it reach?
OpenAI launched ChatGPT Work on 10 July 2026. Its help centre describes it plainly: "Work is an agent designed for longer, multi-step work and finished deliverables." Where regular ChatGPT answers a question, Work goes and does the task: researches a topic, pulls information from connected apps, and produces a document, spreadsheet, presentation, report or site.
The safety question is really a question about reach. Work can touch far more of your data than a chat window does, in four ways:
- Connected apps. Work can use apps you connect, such as email, Slack, calendars and file storage. OpenAI told VentureBeat these connectors "are all based on MCP", the common standard for linking AI tools to other software.
- A cloud computer. On web and mobile, "Work on web and mobile runs in the cloud." VentureBeat describes it as "a persistent cloud-based virtual machine that runs on OpenAI's servers."
- Your desktop. "When allowed by your plan and workspace, Work in the desktop app can also use local files and desktop apps with your permission." Some desktop features "may also require Screen & Audio Recording and Accessibility permissions."
- Schedules. Work "can also run once, repeat on a schedule or trigger, or monitor for changes", which means it can act when you are not watching.
Each of those is useful, and each widens what can go wrong. A chatbot only sees what you paste into it. An agent connected to your inbox sees your inbox, including whatever strangers send to it.
Who can use it
OpenAI's help page says Work "is available on ChatGPT web and mobile for eligible paid plans" and in the desktop app "when included for your plan and workspace." At launch, coverage from TNW said it rolled out first to Pro, Enterprise and Edu, then to Plus and Business, with the desktop app available on every plan. ChatGPT Plus is $20 a month, according to VentureBeat's launch report. Work "follows the same usage structure as Codex", so how much you can do depends on your plan's allowance and the size of each task.
What can go wrong with ChatGPT Work?
Three kinds of risk matter, and OpenAI's own documents name the first one.
1. Prompt injection. This is the risk that is new with agents. A prompt injection is text hidden in something the agent reads, such as an email, a web page or a shared document, that tries to give the agent instructions. OpenAI's help article on agent mode gives a concrete example: while planning a group dinner by checking your calendar and email, the agent "might encounter a malicious comment" "directing it to retrieve a password reset code from Gmail and send it to a malicious website." The agent cannot always tell the difference between your instructions and a stranger's text that looks like instructions.
2. Doing the wrong thing on your behalf. The same article says that when you sign the agent into websites or enable apps, "it can access sensitive data like emails, files, or account settings, and perform actions on your behalf (e.g., sharing files, modifying account settings)." A misunderstood request can share the wrong file or send the wrong email even with no attacker involved.
3. Your data being kept or used. Work tasks pass through OpenAI's systems. Depending on your plan and settings, that data may be retained, reviewed by staff in limited cases, or used to train models. That is not a hack; it is how the service works, and it is configurable.
What safeguards does OpenAI build in?
OpenAI describes several layers. Here they are with what each does and where its limit is, from OpenAI's help pages and launch coverage.
| Safeguard | What it does | Its limit |
|---|---|---|
| Approvals | You "approve important actions" before they happen; on web and mobile you approve or decline with on-screen controls | "Spoken approval is not supported"; you have to read what you approve |
| Confirmations for high-impact actions | The agent pauses before actions such as sharing or changing settings | Depends on the agent recognising an action as high-impact |
| Prompt injection monitoring | OpenAI watches for injected instructions | OpenAI: these measures "don't eliminate all risks" |
| Watch mode | Requires your supervision on certain sites | Only on certain sites |
| Auto-review layer | A model checks important actions before they run | OpenAI's "100%" red-team figure is its own, not independently verified |
| Browser takeover for logins | You type passwords yourself; "screenshots are not captured" while you control the browser | Only covers the moment you are in control |
| Lockdown Mode | Limits outbound network requests to cut data exfiltration | "does not prevent prompt injections from appearing in the content ChatGPT processes" |
The honest summary is in OpenAI's own words: "ChatGPT agent incorporates multiple safeguards" "designed to help prevent harmful or unintended outcomes. However, these measures don't eliminate all risks. It remains important to monitor ChatGPT agent and exercise care when using it." The company that built the tool is telling you not to treat it as fully safe on its own.
TNW reported that OpenAI's auto-review layer "blocked 100% of attempts to extract protected data" in adversarial red-teaming, including attacks the reviewing model had not seen. That is a strong claim, and it is OpenAI's own measurement on its own tests. No independent audit of Work's prompt-injection defences had been published as of 10 November 2026.
Is your data used to train OpenAI's models?
On personal plans, yes by default; on business plans, no by default. OpenAI's data controls FAQ says: "On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default." You can switch it off under Settings, Data controls, by turning off "Improve the model for everyone."
| Account type | Training on your content by default | How to change it |
|---|---|---|
| Free, Plus, Pro (personal) | On | Settings, Data controls, turn off "Improve the model for everyone" |
| Business | Off | Workspace policy applies |
| Enterprise, Edu | Off | Workspace policy; Work requires Enterprise Key Management for eligible workspaces |
| API | Off | Not applicable |
Two details catch people out. First, feedback overrides the setting: "If you choose to provide feedback, such as selecting thumbs up or thumbs down on a response, the entire conversation associated with that feedback may be used to train OpenAI models." Rating a Work task that read your email can put that conversation into training data even with training turned off. Second, the help page on agent mode says content may be accessed by "a limited number of authorized OpenAI personnel" to investigate abuse or security incidents, give support, handle legal matters, or "improve model performance (unless you have opted out)."
Transparency note: CriticNest has no affiliate or commercial relationship with OpenAI, Google, GitHub or Cursor, and no link in this article earns a commission. Every quotation was read on OpenAI's help centre or in published launch coverage on 10 November 2026. ChatGPT Work was not connected to any account or tested for this article.
How long does ChatGPT keep Work chats?
Until you delete them, then up to 90 days. OpenAI's help article on agent mode says chats, browsing history and screenshots "are retained until you delete them," and "Deleted chats and associated screenshots will be deleted from our systems within 90 days." Temporary chats are handled differently: the data controls FAQ says they "may be retained for up to 30 days for safety purposes".
The Work help page adds a point about local tasks that is easy to miss: "Local chats run on your computer. Messages and task context may be stored in the cloud, even when work runs locally." Running Work on the desktop does not mean the content stays on your desktop.
Shared schedules are another place data travels. If you share a scheduled task, OpenAI says sharing does not transfer your chat history, files, device access or connected app credentials, but "The task instructions are included in the shared link, so review them before sharing." If you wrote a client's name or an internal detail into the instructions, it goes with the link.
Should you connect ChatGPT Work to your email?
Connect it if you have a specific job for it and you will watch the first runs. Do not connect it as a general assistant with standing permission to "handle" your inbox. OpenAI's own best-practice list says: "Avoid vague, open-ended prompts like "Check my email and handle everything.""
Email is the hardest case because it is where outsiders can reach the agent. Anyone can send you an email, so anyone can put text in front of an agent that reads your inbox. It is also where password reset links arrive, which is why OpenAI's prompt injection example targets a reset code. A narrow task ("summarise the five newest emails from this client") is far safer than a broad one ("go through my inbox and reply where needed").
Connected files are a middle case. App access "does not override permissions in the connected source system," according to OpenAI's Lockdown Mode page, so Work sees what your account can see. If your account can open the whole company drive, so can the agent. Calendars are lower risk, though a calendar invite from a stranger is still outside text the agent will read.
How to set up ChatGPT Work safely
- Turn off model training if you are on a personal plan. Settings, Data controls, "Improve the model for everyone" off. Avoid thumbs up or down on tasks that touched private data.
- Connect only what the task needs. OpenAI's list says: "Regularly review and manage app permissions in your settings." Disconnect apps you are not using.
- Write narrow instructions. Name the folder, the sender, the date range. The tighter the task, the less room for a hidden instruction to redirect it.
- Read every approval. Approvals only protect you if you look at what you are approving. Decline anything you did not expect.
- Stop when something looks off. OpenAI: "Stop tasks immediately if something seems suspicious."
- Keep passwords out of prompts. OpenAI advises against typing passwords or private information into messages; use browser takeover to sign in yourself. A password manager that fills logins for you is the right tool for credentials, and our explainer on how 1Password stores passwords in the cloud covers how one handles them.
- Clear browser data after sensitive sessions. OpenAI lists "Clear remote browser data after sensitive sessions" as a best practice.
- Consider Lockdown Mode for sensitive work. It "may be available to eligible personal accounts, self-serve ChatGPT Business accounts, and supported managed workspaces." It limits live browsing, file downloads and some network features to cut the chance of data leaving. It costs convenience and, by OpenAI's own account, does not stop injections from appearing.
- Be careful with desktop permissions. Screen recording and accessibility permissions let an app see and control a lot. Grant them only if you use the desktop features, and revoke them in your system settings if you stop.
- Delete what you no longer need. Deleted chats are removed within 90 days; chats you keep stay until you delete them.
For teams and companies
Workspace admins get more control. OpenAI's help page says owners and admins "can manage Work for the default workspace role and custom roles in Workspace settings," with Work Local and Work Cloud controlled separately, and "Browser use and network access" governed by their own settings. TNW reported that Enterprise and Edu admins can manage "who has access, what company context the model can use, which tools it can connect to and what actions it can take," with a Compliance API for oversight. For eligible Enterprise and Edu workspaces, the help page says Work requires Enterprise Key Management and "is enabled by default for members who use the default workspace role unless a workspace owner or admin turns it off." If you run a workspace, decide your policy before staff find the feature on their own.
How ChatGPT Work compares with other AI tools that touch your data
Every AI tool that reads your private material raises the same three questions: what it can reach, where the data goes, and whether it is used for training. Coding assistants were the first place most people met them. Our guides to whether GitHub Copilot is safe for private code and whether Cursor sends your code to the cloud walk through those questions for developers.
Work raises the stakes because it can act, not just read and suggest. A coding assistant that sees your code can leak it; an agent that can send email and share files can also do things in your name. That is why approvals and narrow permissions matter more here than in a chat window.
Google's consumer AI plans are moving in a different direction on price. Our look at whether Google AI Plus is still worth it covers Google's 13 November change, which removes Pro model selection from its cheapest paid plan.
The short version
ChatGPT Work is an agent that can read connected apps, browse, use your desktop with permission and run on a schedule. OpenAI builds in approvals, confirmations, prompt injection monitoring, watch mode, an auto-review layer and an optional Lockdown Mode, and it says plainly that these "don't eliminate all risks." The main risk is prompt injection through content strangers can send you, especially email. On personal plans, training on your data is on by default, chats stay until you delete them, and rating a response can put a whole conversation into training. Turn training off, connect only what each task needs, write narrow instructions, read every approval, and keep passwords out of it. Used that way, it is a reasonable tool; connected to everything with a vague instruction, it is not.
Frequently asked questions
Is ChatGPT Work safe to use?
It is reasonably safe if you set it up carefully. OpenAI builds in approvals, confirmations for high-impact actions, prompt injection monitoring and an optional Lockdown Mode, but its own help pages say these measures "don't eliminate all risks." Connect only the apps a task needs, approve actions yourself and turn off model training on personal plans.
What is prompt injection in ChatGPT Work?
Hidden text in something the agent reads, such as an email or web page, that tries to give it instructions. OpenAI's own example is a malicious comment directing the agent to retrieve a password reset code from Gmail and send it to a malicious website. It is the main new risk with agents that read outside content.
Does ChatGPT Work use my data for training?
On personal Free, Plus and Pro accounts, data sharing is on by default, according to OpenAI's data controls FAQ. Turn off "Improve the model for everyone" in Settings, Data controls. By default OpenAI does not train on Business, Enterprise or Edu workspace content. Giving feedback on a response can still share that conversation for training.
Can ChatGPT Work read my email?
Only if you connect your email app to it. Once connected, it can read and act on what your account can access, subject to your approvals. OpenAI advises against open-ended prompts like "Check my email and handle everything." Narrow, specific tasks are far safer.
How long does OpenAI keep ChatGPT Work chats?
OpenAI's help article on agent mode says chats, browsing history and screenshots are kept until you delete them, and deleted chats and screenshots are removed from its systems within 90 days. Temporary chats may be kept for up to 30 days for safety purposes.
Does running ChatGPT Work on my desktop keep my data local?
Not entirely. OpenAI's help page says: "Local chats run on your computer. Messages and task context may be stored in the cloud, even when work runs locally." Desktop features can also need Screen and Audio Recording and Accessibility permissions, so grant those only if you use them.
What is Lockdown Mode in ChatGPT?
An optional security setting that limits outbound network requests to reduce the risk of data being sent out by a prompt injection. It limits live browsing to cached content and restricts downloads and some network features. OpenAI says it does not stop injections from appearing in content ChatGPT processes.
Can OpenAI staff see my ChatGPT Work content?
In limited cases. OpenAI's agent help article says content may be accessed by a limited number of authorized personnel and trusted service providers to investigate abuse or security incidents, provide support, handle legal matters, or improve model performance unless you have opted out. Access is logged and restricted.
Is ChatGPT Work safe for business use?
It can be, with admin controls in place. Business, Enterprise and Edu content is not used for training by default, and admins can control access, connected tools, browser use and actions. For eligible Enterprise and Edu workspaces Work is on by default for the default role, so set a policy early.
How much does ChatGPT Work cost?
Work has no separate subscription. It is included with eligible ChatGPT plans and follows the same usage structure as Codex, so heavy tasks use more of your allowance. ChatGPT Plus is $20 a month, according to VentureBeat's launch coverage, and higher Pro, Business and Enterprise plans include more usage.
