{"course":{"slug":"ai-actually-explained","title":"AI, Actually Explained","url":"https://addaly.com/learn/ai-actually-explained","level":"beginner","track":"start"},"lesson":{"slug":"the-assistant-inside-your-apps","title":"The assistant inside your email and spreadsheet","url":"https://addaly.com/learn/ai-actually-explained/the-assistant-inside-your-apps","position":68,"of":92,"minutes":9,"answer":"An assistant built into a product is the same model plus a search over what the product has indexed under your permissions, so it sees exactly what you could find and nothing else.","keyIdea":"An assistant built into a product is the same model plus a search over what the product has indexed under your permissions, so it sees exactly what you could find and nothing else, and an email can give it orders."},"body":{"format":"markdown","text":"## Same model, different desk\n\nThe chatbot in a browser tab starts with an empty desk. The assistant built into your email, your documents, your spreadsheet or your phone starts with a desk the product has laid out for it. That is the entire difference, and the mechanism is one you have already met: the search bolted onto a model, from the lesson on why it is not a search engine.\n\nWhen you ask the assistant in your mail client to summarise a thread, the product fetches the thread, puts it into the context window, and asks the model. When you ask it what you agreed with a supplier last quarter, the product runs a search over your mailbox and your files, takes the top results, puts *those* into the window, and asks the model. The model never has your mailbox. It has whatever the search returned, this time.\n\n## What it can see\n\nExactly what you can see, and no more. The assistant runs under your account's permissions. If you can open a file, so can it; if a folder is shared with everyone in the company, so is the assistant's view of it.\n\nThat second half produced the first big embarrassment of these products. Companies that switched them on in 2024 found the assistant cheerfully answering questions from files that had been shared too widely years earlier and forgotten (salary spreadsheets, board papers) because the search found them and the permissions allowed it. Nothing was leaked that was not already accessible. It had never been *found* before. The vendors added controls to restrict what the search may cover, and the honest lesson is that an assistant is a permission audit you did not order.\n\n## What it cannot see\n\nThe attachment, unless the product indexes attachments, and many summarise the thread while missing that the decision was in the PDF. Images in emails. Anything in the other company's product. Anything the search did not rank highly enough to return, which is why the same question answered twice can cite different emails. And your intent: it does not know that \"the contract\" means the one you are worried about rather than the one with the same name from 2019.\n\nAsk it what it looked at. Most of these products will list the sources they used, and reading the list is the fastest way to discover that the confident summary drew on two of the five relevant emails.\n\n## The email that gives it orders\n\nThe module on why it goes wrong warned that text the model reads can tell it what to do. Inside an email assistant that is not a curiosity. In 2025 a security firm disclosed a flaw in one of the major products in which an ordinary-looking email, containing hidden instructions, caused the assistant to gather information from the user's other files and send it out, with no click from the user, because the assistant read the email as part of answering an unrelated question. The vendor fixed that instance. The class of attack is a property of putting a text-reading model in front of an inbox, and it will recur in new forms.\n\nThe practical rule: an assistant that can *read* your data and *act* (send, forward, share) is a different risk from one that only reads. The next lesson is about that line.\n\n## On the phone\n\nPhone makers took a different route. The assistant on a recent phone runs a small model on the device for most tasks (the kind from the lesson on running a model locally) and sends only the hard requests to a server, in at least one case to a server designed so the company itself cannot read what was sent. The advantage is that your messages and photographs mostly do not leave the handset. The cost is that the on-device model is a small one, with a small model's limits.\n\nOne desktop product announced a feature in 2024 that took a screenshot of everything on screen every few seconds and indexed it so the assistant could answer questions about anything you had seen. It was delayed for a year after security researchers showed the index was readable by any program on the machine, and shipped as opt-in with encryption. The feature is the logical end of laying out the desk. Whether you want it is a question about who else can sit at it.\n\n## The free path\n\nEverything above has a free equivalent with more seams and less polish. A local model from the earlier lesson, a free open-source chat interface that can search a folder of your documents, and the free office suite and mail client most people already have. It will not summarise your inbox unasked. For a great many people, that is the feature."},"check":{"question":"An assistant inside a company's mail and file system answers a question using a salary spreadsheet the user had never seen. What happened?","options":[{"text":"The assistant bypassed the file's permissions to find the answer.","correct":false,"tempting":"Assumes a breach; the assistant runs under the user's permissions and cannot open what the user cannot."},{"text":"The model had memorised the spreadsheet during training on the company's data, and reproduced it when the question matched.","correct":false,"tempting":"Confuses training with retrieval; the assistant searched the live file store at question time."},{"text":"The file had been shared too widely years earlier, and the search found what the user could always have opened.","correct":true},{"text":"The assistant invented the spreadsheet and its contents, as models do with specifics.","correct":false,"tempting":"Reaches for hallucination; the file was real, and the failure was in what the search was allowed to cover."}]},"prev":{"slug":"what-a-query-costs","title":"What a query costs, in rupees and watt-hours","url":"https://addaly.com/learn/ai-actually-explained/what-a-query-costs"},"next":{"slug":"when-it-starts-to-act","title":"When it starts to act","url":"https://addaly.com/learn/ai-actually-explained/when-it-starts-to-act"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'The assistant inside your email and spreadsheet', in AI, Actually Explained. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-actually-explained/the-assistant-inside-your-apps (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"The assistant inside your email and spreadsheet","courseTitle":"AI, Actually Explained","module":{"index":7,"slug":"putting-it-to-work","title":"Putting it to work without getting burned"},"answer":null,"keyIdea":"An assistant built into a product is the same model plus a search over what the product has indexed under your permissions, so it sees exactly what you could find and nothing else, and an email can give it orders.","hero":{"kind":"plate","image":"https://addaly.com/art/modules/ai-actually-explained/putting-it-to-work.webp","alt":"A coaching-centre desk with a stack of books, a phone, an open folder of notes, a steel tumbler and a plain wall calendar above.","caption":"Using these tools well is mostly a matter of what you put on the desk beside them and what you decide never to hand over."},"blocks":[{"t":"h2","id":"same-model-different-desk","runs":[{"text":"Same model, different desk"}]},{"t":"p","runs":[{"text":"The chatbot in a browser tab starts with an empty desk. The assistant built into your email, your documents, your spreadsheet or your phone starts with a desk the product has laid out for it. That is the entire difference, and the mechanism is one you have already met: the search bolted onto a model, from the lesson on why it is not a search engine."}]},{"t":"p","runs":[{"text":"When you ask the assistant in your mail client to summarise a thread, the product fetches the thread, puts it into the context window, and asks the model. When you ask it what you agreed with a supplier last quarter, the product runs a search over your mailbox and your files, takes the top results, puts "},{"text":"those","i":true},{"text":" into the window, and asks the model. The model never has your mailbox. It has whatever the search returned, this time."}]},{"t":"h2","id":"what-it-can-see","runs":[{"text":"What it can see"}]},{"t":"p","runs":[{"text":"Exactly what you can see, and no more. The assistant runs under your account’s permissions. If you can open a file, so can it; if a folder is shared with everyone in the company, so is the assistant’s view of it."}]},{"t":"p","runs":[{"text":"That second half produced the first big embarrassment of these products. Companies that switched them on in 2024 found the assistant cheerfully answering questions from files that had been shared too widely years earlier and forgotten (salary spreadsheets, board papers) because the search found them and the permissions allowed it. Nothing was leaked that was not already accessible. It had never been "},{"text":"found","i":true},{"text":" before. The vendors added controls to restrict what the search may cover, and the honest lesson is that an assistant is a permission audit you did not order."}]},{"t":"h2","id":"what-it-cannot-see","runs":[{"text":"What it cannot see"}]},{"t":"p","runs":[{"text":"The attachment, unless the product indexes attachments, and many summarise the thread while missing that the decision was in the PDF. Images in emails. Anything in the other company’s product. Anything the search did not rank highly enough to return, which is why the same question answered twice can cite different emails. And your intent: it does not know that “the contract” means the one you are worried about rather than the one with the same name from 2019."}]},{"t":"p","runs":[{"text":"Ask it what it looked at. Most of these products will list the sources they used, and reading the list is the fastest way to discover that the confident summary drew on two of the five relevant emails."}]},{"t":"h2","id":"the-email-that-gives-it-orders","runs":[{"text":"The email that gives it orders"}]},{"t":"p","runs":[{"text":"The module on why it goes wrong warned that text the model reads can tell it what to do. Inside an email assistant that is not a curiosity. In 2025 a security firm disclosed a flaw in one of the major products in which an ordinary-looking email, containing hidden instructions, caused the assistant to gather information from the user’s other files and send it out, with no click from the user, because the assistant read the email as part of answering an unrelated question. The vendor fixed that instance. The class of attack is a property of putting a text-reading model in front of an inbox, and it will recur in new forms."}]},{"t":"p","runs":[{"text":"The practical rule: an assistant that can "},{"text":"read","i":true},{"text":" your data and "},{"text":"act","i":true},{"text":" (send, forward, share) is a different risk from one that only reads. The next lesson is about that line."}]},{"t":"h2","id":"on-the-phone","runs":[{"text":"On the phone"}]},{"t":"p","runs":[{"text":"Phone makers took a different route. The assistant on a recent phone runs a small model on the device for most tasks (the kind from the lesson on running a model locally) and sends only the hard requests to a server, in at least one case to a server designed so the company itself cannot read what was sent. The advantage is that your messages and photographs mostly do not leave the handset. The cost is that the on-device model is a small one, with a small model’s limits."}]},{"t":"p","runs":[{"text":"One desktop product announced a feature in 2024 that took a screenshot of everything on screen every few seconds and indexed it so the assistant could answer questions about anything you had seen. It was delayed for a year after security researchers showed the index was readable by any program on the machine, and shipped as opt-in with encryption. The feature is the logical end of laying out the desk. Whether you want it is a question about who else can sit at it."}]},{"t":"h2","id":"the-free-path","runs":[{"text":"The free path"}],"role":"free"},{"t":"p","runs":[{"text":"Everything above has a free equivalent with more seams and less polish. A local model from the earlier lesson, a free open-source chat interface that can search a folder of your documents, and the free office suite and mail client most people already have. It will not summarise your inbox unasked. For a great many people, that is the feature."}]}],"check":{"question":[{"text":"An assistant inside a company’s mail and file system answers a question using a salary spreadsheet the user had never seen. What happened?"}],"options":[{"text":[{"text":"The assistant bypassed the file’s permissions to find the answer."}],"correct":false,"tempting":[{"text":"Assumes a breach; the assistant runs under the user’s permissions and cannot open what the user cannot."}]},{"text":[{"text":"The model had memorised the spreadsheet during training on the company’s data, and reproduced it when the question matched."}],"correct":false,"tempting":[{"text":"Confuses training with retrieval; the assistant searched the live file store at question time."}]},{"text":[{"text":"The file had been shared too widely years earlier, and the search found what the user could always have opened."}],"correct":true,"tempting":null},{"text":[{"text":"The assistant invented the spreadsheet and its contents, as models do with specifics."}],"correct":false,"tempting":[{"text":"Reaches for hallucination; the file was real, and the failure was in what the search was allowed to cover."}]}],"order":[1,2,3,0],"why":null},"prev":{"slug":"what-a-query-costs","title":"What a query costs, in rupees and watt-hours","minutes":9},"next":{"slug":"when-it-starts-to-act","title":"When it starts to act","minutes":10}}}