Connecting Agents to Your Accounts

Desktop agents are most useful when they can work in the tools you already use: your email, calendar, files, and project tools. Giving an agent that access is safe when you do it the right way. This page explains how to connect an agent to your accounts without ever handing it your password, and how to keep that access small, visible, and easy to take back.

The short version

  • Never give an agent your password, 2FA code, or Okta push. Not in chat, not in a file, not in a prompt.
  • Use an approved connector whenever one exists. You sign in on the real provider's page, and the agent gets a limited pass you can revoke.
  • Let it read freely, but make it ask before it writes. Anything that sends, deletes, edits, or shares should need your approval.
  • Connect only what the task needs, and disconnect when you're done.
  • Remember the agent acts as you. Whatever it does shows up in that system's logs under your name.

Why not just give the agent your password?

A password is a house key. Whoever holds it can do everything you can, in every part of the account, until you change it. A password typed into a chat or saved in a file can also end up in conversation history, logs, or the cloud copy of a task.

A connector works more like a valet key. You sign in yourself on the provider's own page (for University accounts, that usually means Notre Dame's Okta sign-in), and the provider gives the agent a limited, revocable pass. The agent never sees your password. You can see what it's allowed to do, and you can cancel the pass at any time without changing your password.

If an agent asks for your password, a 2FA code, or an API key in chat, stop. A legitimate connector or sign-in screen will never ask you to type credentials into the conversation. A request like that may be a sign of a hidden instruction (prompt injection) in something the agent read.

Ways to give an agent access, safest first

Options for connecting a desktop agent to your accounts
Method How it works Use it for Watch out for
1. Approved connector Pick the app from the agent's built-in connector list and sign in on the provider's page. The agent gets scoped, revocable access. Email, calendar, cloud storage, GitHub, and project tools. Your default choice. The connector can reach everything your account can reach, not just what the task needs.
2. Agent's own browser, you sign in The agent uses a separate browser and pauses at a sign-in page so you can enter credentials yourself, directly into the site. Websites that don't have a connector. The site may stay signed in for later tasks until you clear it.
3. Your own browser or screen The agent works in your everyday browser (for example, Claude in Chrome) or controls your computer. Short, supervised tasks on trusted sites. It inherits every account you're already signed in to in that browser, with fewer permission checks.
4. Access token or API key You create a key in the service and store it where a tool can use it. Developers only, when no connector exists. Keys are easy to leak and hard to track. Scope them tightly and set an expiration.

Before you connect anything

Ask yourself four questions:

  1. Is this connector approved for Notre Dame use? Only connectors your ChatGPT EDU or Claude workspace admins have turned on are approved. Custom connectors and third-party plugins are not verified by OpenAI or Anthropic. If what you need isn't available, ask the Service Desk rather than finding a workaround.
  2. What data can this account see? A connector exposes your whole inbox, calendar, or drive, not just the messages or files the task is about. If that account holds data your agent isn't approved for (see the data table on the Desktop Agents page), don't connect it.
  3. Does the task need to change anything? Summarizing, searching, and drafting only need read access. Keep write actions behind approval or blocked.
  4. Will I be watching? If the task will run unattended or on a schedule, connect less and allow fewer actions.
FERPA and Claude: don't connect services that hold student records. Claude Cowork is not approved for FERPA-covered data, and a connector gives Claude access to everything in the connected account. If you teach, advise, or work with student records, assume your Notre Dame email, calendar, and drive contain FERPA-covered information, such as grades, advising notes, accommodation details, or messages with students about their coursework. Do not connect those accounts to Claude. The same applies to other services that hold student records. For tasks involving FERPA-covered data, use ChatGPT Work in Notre Dame's ChatGPT EDU workspace instead. Restricted/Highly Sensitive data is not approved for any desktop agent.

Setting up a connection safely

  1. Start from the agent's settings

    Add connectors from the agent's own connector or app directory, not from a link in an email, chat, or web page.

  2. Sign in on the real provider page

    Check the address bar before you type anything. University accounts should take you to Notre Dame's normal sign-in. Approve only Okta pushes you started yourself, seconds ago.

  3. Read the permission screen

    The provider will list what the agent is asking to do, such as "read your email" or "send email on your behalf." If it asks for far more than your task needs, cancel and ask the Service Desk.

  4. Set what the agent can do without asking

    Allow read actions, require approval for anything that sends, edits, deletes, or shares, and block tools you'll never use. Details for each product are below.

  5. Turn on only what this task needs

    Most agents let you switch connectors on and off per task. An agent working on a slide deck doesn't need your inbox.

  6. Test with something low-stakes

    Try a read-only task first, like "list tomorrow's meetings," and watch which tools the agent uses.

Where to find the settings

ChatGPT Work

Apps (formerly called connectors) are how ChatGPT reaches your accounts. ChatGPT EDU workspace admins decide which apps are available and whether they can only read or can also take actions. When ChatGPT asks you to confirm an action, read what it's about to do before you approve it.

For sites without an app, Work can use a cloud browser. When it reaches a sign-in page, it pauses and gives you a secure form so your password goes to the website, not to the model. That signed-in session can stay active for later tasks, so clear it when you're done: Settings > Cloud browser > Browser data.

Claude Cowork

Connectors are under Customize > Connectors. Select a connector to see its tool permissions, then set each one to Always allow, Needs approval, or Blocked. A good starting point is Always allow for read tools, Needs approval for anything that writes, and Blocked for what you won't use.

Cowork can also work in a built-in browser or in Claude in Chrome, where it can see pages you're signed in to. Anthropic advises against using either for tasks involving sensitive information. Close unrelated tabs, and use a separate Chrome profile with only the accounts the task needs.

Connecting common tools

Email

Email is the riskiest connection because your inbox is full of messages from people outside your control, and any of them could contain hidden instructions. Let the agent search, summarize, and draft. Keep send on Needs approval or Blocked, and send drafts yourself from your own mail app. If your inbox contains student records, don't connect it to Claude at all (see FERPA and Claude above).

Calendar

Reading availability is low risk. Creating, changing, or canceling events, and sending invitations, should need your approval, since invitations go to other people under your name.

Cloud storage

A drive connector can reach every file shared with you, including files in shared drives you may have forgotten about. Prefer pointing the agent at a specific folder or file, and keep editing, sharing, and deleting behind approval.

GitHub

Use the GitHub connector rather than a personal access token. If you must use a token, create a fine-grained token limited to specific repositories, with read-only permissions where possible and a short expiration date. Never paste the token into a chat.

Watch for the risky combination

Most serious agent incidents need three things at once:

  1. Access to private data, such as your inbox or files.
  2. Exposure to untrusted content, such as outside email, unfamiliar websites, or shared documents.
  3. A way to send data out, such as sending email, posting, sharing a file, or visiting a web address.

When a task combines all three, a single hidden instruction can turn your agent against you, for example by forwarding your files to a stranger. Remove any one of the three and the risk drops sharply. Keep send and share actions behind approval, limit web access to trusted sites, and avoid giving one task both your inbox and the open web.

Credentials already on your computer

Desktop agents can find credentials you didn't mean to share. Configuration files, saved tokens, SSH keys, and .env files often sit in project and home folders. Command-line tools an agent runs on your behalf may also reuse logins you've already saved.

  • Connect a dedicated working folder, never your whole home or Documents folder.
  • Keep passwords, keys, and tokens out of any folder you connect.
  • Store credentials in a password manager, not in text files or notes.

Clean up when you're done

  • Disconnect connectors you no longer use, or switch them off for future tasks.
  • Clear browser sessions the agent signed in to, such as ChatGPT's cloud browser data.
  • Pause or delete scheduled tasks you're not actively using.
  • Revoke unused access a few times a year. Check your Google account connections and your GitHub authorized applications, and delete tokens you no longer need.

If something goes wrong

If an agent sends, changes, or shares something you didn't ask for, or you think a password or key was exposed:

  1. Stop the task.
  2. Disconnect the connector, clear the browser session, or revoke the token.
  3. Change your password if you typed it anywhere other than the provider's real sign-in page.
  4. Contact the Service Desk right away, even if you're not sure anything bad happened.

Common questions

The agent asked me to paste my password so it could sign in. What should I do?

Don't. Stop the task and check what the agent was reading when it asked. Legitimate sign-ins happen on the provider's own page or in a secure sign-in form, never in the chat. If you already pasted it, change your password and contact the Service Desk.

The connector I need isn't in the list. Can I add a custom one?

Not for University work without approval. Custom connectors, plugins, and browser extensions can see your data and are not verified by OpenAI or Anthropic. Ask the Service Desk whether the tool can be approved for your workspace.

Can a scheduled task send email for me?

We recommend against it. Scheduled tasks run while no one is watching, so a mistake or hidden instruction can play out before you notice. Have the task prepare drafts, then review and send them yourself.

Approving every action is slowing me down. Can I switch to "always allow"?

For read actions, yes. For actions that send, delete, edit, or share, keep approvals on unless the task is low-stakes and you're watching it. Some write approvals may be required by your workspace's settings.

If I connect my email, can the agent read all of it?

Yes. A connector has the same access you do in that system. It can't see anything you can't, but it can see everything you can, including old messages and files shared with you.

Learn more