The assistant inside your email and spreadsheet

Same model, different desk

The chatbot in a browser tab starts with an empty desk. The assistant built into your email, your documents, your spreadsheet or your phone starts with a desk the product has laid out for it. That is the entire difference, and the mechanism is one you have already met: the search bolted onto a model, from the lesson on why it is not a search engine.

When you ask the assistant in your mail client to summarise a thread, the product fetches the thread, puts it into the context window, and asks the model. When you ask it what you agreed with a supplier last quarter, the product runs a search over your mailbox and your files, takes the top results, puts those into the window, and asks the model. The model never has your mailbox. It has whatever the search returned, this time.

What it can see

Exactly what you can see, and no more. The assistant runs under your account’s permissions. If you can open a file, so can it; if a folder is shared with everyone in the company, so is the assistant’s view of it.

That second half produced the first big embarrassment of these products. Companies that switched them on in 2024 found the assistant cheerfully answering questions from files that had been shared too widely years earlier and forgotten (salary spreadsheets, board papers) because the search found them and the permissions allowed it. Nothing was leaked that was not already accessible. It had never been found before. The vendors added controls to restrict what the search may cover, and the honest lesson is that an assistant is a permission audit you did not order.

What it cannot see

The attachment, unless the product indexes attachments, and many summarise the thread while missing that the decision was in the PDF. Images in emails. Anything in the other company’s product. Anything the search did not rank highly enough to return, which is why the same question answered twice can cite different emails. And your intent: it does not know that “the contract” means the one you are worried about rather than the one with the same name from 2019.

Ask it what it looked at. Most of these products will list the sources they used, and reading the list is the fastest way to discover that the confident summary drew on two of the five relevant emails.

The email that gives it orders

The module on why it goes wrong warned that text the model reads can tell it what to do. Inside an email assistant that is not a curiosity. In 2025 a security firm disclosed a flaw in one of the major products in which an ordinary-looking email, containing hidden instructions, caused the assistant to gather information from the user’s other files and send it out, with no click from the user, because the assistant read the email as part of answering an unrelated question. The vendor fixed that instance. The class of attack is a property of putting a text-reading model in front of an inbox, and it will recur in new forms.

The practical rule: an assistant that can read your data and act (send, forward, share) is a different risk from one that only reads. The next lesson is about that line.

On the phone

Phone makers took a different route. The assistant on a recent phone runs a small model on the device for most tasks (the kind from the lesson on running a model locally) and sends only the hard requests to a server, in at least one case to a server designed so the company itself cannot read what was sent. The advantage is that your messages and photographs mostly do not leave the handset. The cost is that the on-device model is a small one, with a small model’s limits.

One desktop product announced a feature in 2024 that took a screenshot of everything on screen every few seconds and indexed it so the assistant could answer questions about anything you had seen. It was delayed for a year after security researchers showed the index was readable by any program on the machine, and shipped as opt-in with encryption. The feature is the logical end of laying out the desk. Whether you want it is a question about who else can sit at it.

The free path

Everything above has a free equivalent with more seams and less polish. A local model from the earlier lesson, a free open-source chat interface that can search a folder of your documents, and the free office suite and mail client most people already have. It will not summarise your inbox unasked. For a great many people, that is the feature.