ChatGPT Voice can read mail and calendars. Don’t plug in the company inbox
On 23 September OpenAI said ChatGPT Voice can use already-connected plugins — mail, calendars and Slack were named — and can run GPT-6 models inside Work for docs, decks and sheets. The door changed from typing to speaking. The rights did not: whether a plugin can read mail, send mail, or post in Slack still depends on the scopes that account already granted, and on what the plan allows.
Public reporting also draws a line: actions that need a yes, such as sending mail or posting in Slack, still wait for the person logged into that account to tap on screen. A spoken yes is not the approval. That sounds contained. The real split is whose mailbox is attached. One path is a company-paid workspace, where an admin decides whether Gmail can send and whether Slack can post. The other is an employee on a consumer account who authorises work Gmail to read and send. The company never signed that agreement with OpenAI, and a company admin cannot see, in the company admin, which scopes the employee ticked on the personal account.
Once connected, the model can usually see whatever that plugin was ticked for. If the tick was read and send, Voice is only a spoken way to give the instruction. The confirm tap on screen may stop that letter from being sent. It does not undo the fact that the personal ChatGPT account already read the body. Calendars and Slack channels work the same way: if read was ticked, meeting titles, attendees and channel messages are already in that account before anyone taps confirm. Once a personal account is wired to work mail, the company admin has no remote switch that pulls the grant. If the employee leaves, the admin can disable the work mailbox, but cannot open that personal ChatGPT and delete what it already read. If the employee changes phones, the connection stays on the ChatGPT account, not on the old phone. If the employee lets family use the same ChatGPT login, family can ask voice mode about work mail.
That is not the same stack as site or LINE support. A bot that only reads prices you approved, shows a summary before a reschedule, and writes the lead into the admin only after the customer taps, has a written fence: what it may read, which fields it may write, and that a person taps before the write. A private ChatGPT on the company inbox has no such list. Voice only changes the input from the keyboard to speech. It does not add that list.
In practice, the person in charge asks sales and support whether company Gmail, the company Google Calendar, or company Slack sit on a personal ChatGPT account. If yes, that employee opens ChatGPT connections and disconnects those apps. That is not a DNS change on the company domain. If speech is going to handle official mail, open a company-paid workspace and let an admin choose which plugins exist and whether that plugin can send mail. Quotes, client lists and prices that are not public yet stay out of the personal account. Do not paste them, and do not read them aloud into that account. Asking a personal calendar “am I free at three” is fine, because that calendar is not the company one.
If the company has no workspace yet, you do not need a pile of plugins because of this launch. Write “work mail must not be authorised to a personal AI account” into the staff rules you already have. If it is already connected and nobody remembers whether the tick was read-only or read-and-send, that employee opens their own ChatGPT connections and removes the Google account on the company domain, and the company Slack. What comes off is the grant on the personal account, not a DNS record. Removing it now is better than guessing from memory which letters that account already read. Removal stops later reads. It is not a button in the company admin that pulls back what was already read. Support: AI services. Admin passwords and click-the-screen models: that note.
Two scenes that match
Car park, phone on the dash, spoken to voice: “Am I free at three? Forward that quote to me.” If the calendar being asked is a personal one, the worst case is a missed meeting. If the Gmail being read is the company inbox and the plugin can send, the client name, the price and the attachment text in that quote go into this personal ChatGPT history. The company admin cannot see that history, and cannot turn the plugin off from the company admin. A spoken request plus a confirm tap on screen can also send the quote out of the company mailbox.
The other scene is the commute. The account is personal ChatGPT, and the work mailbox is authorised to read. The reply to the client is still unsent, and the client name and the price have already been seen by that personal account. Anyone else logged into the same account can ask again. That is not the same as asking the weather out loud. The weather does not contain a client quote.
FAQs
If I say “send the quote”, does it go out?
Public reporting says actions that need a yes, such as sending mail or posting, still wait for the person logged into that ChatGPT account to tap confirm on screen. A spoken yes is not the approval. Whether the plugin can read mail or also send it still depends on the scopes that account already ticked, and on what the plan allows.
We run LINE support. Is this the same stack?
No. A support bot that only reads knowledge you approved, and writes a lead into the admin only after the customer taps, is one line. An employee connecting company Gmail to a personal ChatGPT account is another line, and often nobody at the company administers that connection.
Can sales use voice for the diary in the car?
Asking a personal calendar is fine. Company mail, quotes and client lists should not be connected to a consumer account. If voice has to handle company mail, use a company-paid workspace and let an admin decide which plugins may be on and whether mail can send.
Talk mail access and support bots AI services
Source: @OpenAI, 23 Sep 2026. Plans and permissions follow ChatGPT’s live settings.