Should You Give Your Agent Access to Your Calendar?
Most agents need your free/busy and a calendar of their own, not read and write access to yours. What full access exposes, and the setup that keeps your calendar yours.
- calendar
- ai-agents
- agent-security
- prompt-injection
- scheduling
TL;DR
- Most agents should not get read and write access to your calendar. They need to know when you're busy, and a calendar of their own to book on.
- Full read access shows the agent every meeting title, attendee, description and call link on your calendar. Write access lets it create, move and delete meetings that other people are on.
- Calendar invites are written by whoever sends them. An agent that reads your calendar also reads text that strangers put there.
- The safer setup is free/busy access to your calendar, plus a calendar the agent owns. The agent books on its own calendar and invites you, and you accept or decline.
- Every AgentMail inbox comes with its own calendar at the same address, so the agent that emails a prospect is the same one that sends the invite.
Most agents that work with a calendar get access the same way. Someone wires up Google or Outlook, approves a consent screen that asks for full calendar access, and moves on to the part of the project they care about.
That is usually more than the agent needs. A sales agent booking demos or a recruiting agent setting up interviews needs two things from you: when you're busy, and a way to put a meeting in front of you.
So the short answer is no. Share your free/busy, and give the agent a calendar of its own to book on and invite you from.
What does full calendar access give an agent?
Read access is more than a list of times. It is the title of every meeting, everyone on the invite, the description, whatever notes got pasted into it, and the link to join. Your calendar knows about the call with your lawyer on Thursday and the 1:1 where you're telling someone their role is going away.
An agent with read access sees all of that every time it checks your week, and it all goes into the model's context and whatever logs your setup keeps.
Write access goes further. The agent can create events on your calendar, move them and delete them. Changing a meeting you organize can also send an update to everyone on it, from your account. When the agent gets something wrong, the mistake shows up in other people's inboxes with your name on it.
Why are calendar invites a risk for agents?
Anyone who has your email address can send you an invite. They write the title, the description and the location, and an agent that reads your calendar reads that text as part of doing its job.
Google Calendar's default setting adds invitations from everyone, so a stranger's event is on your calendar before you've accepted it. You can change that to "Only if the sender is known," but it isn't the default.
In 2025, researchers at SafeBreach showed that Google's Gemini could be hijacked through a calendar invite. They hid instructions in an event, the victim asked Gemini about their schedule, and Gemini followed the instructions. Google has since shipped fixes, but the setup they used is common. Any agent that reads text a stranger can write has the same exposure.
In January 2026, Miggo Security found a version that needed both read and write access. The hidden instructions told Gemini to summarize the victim's private meetings and save that summary in a new event, which the attacker could see. In their demo, all the victim did was ask Gemini whether they had any meetings on Tuesday.
One bad invite reaches whatever the agent can reach. With full access, that's your whole calendar.
What does the agent need from your calendar?
It needs to know when you're busy so it doesn't book over your lunch. Google and Outlook both let you share availability without the details. In Google Calendar you can share as "See only free/busy," and the Google Calendar API has a calendar.freebusy scope that returns busy blocks and nothing else. In Outlook the sharing level is "Can view when I'm busy."
Everything else the agent does can happen on its own calendar. It books the demo there, with you and the prospect invited. You get a normal invite and you accept or decline it, the way you would with a coworker. If the agent books the wrong slot, it sits on the agent's calendar until you say yes.
| Full access to your calendar | Free/busy plus its own calendar | |
|---|---|---|
| What the agent sees | Every title, attendee, description and call link | The times you're busy |
| What it can change | Anything on your calendar | Events on its own calendar |
| How a meeting gets on your day | The agent puts it there | You accept the agent's invite |
| What a malicious invite can reach | Your whole calendar | The agent's calendar |
| Who the other side sees inviting them | You | The agent, from its own address |
When does an agent need write access to your calendar?
Some agents exist to manage your calendar. An assistant that reshuffles your week, declines meetings on your behalf or moves your 1:1s when something urgent comes up has to write to your calendar, because that is the job. If that's what you're building, it's a reasonable call. Grant the narrowest scope that does the job, and read what the agent changes for the first few weeks.
Most agents aren't that. They book meetings with other people and need to know when you're free. For those, write access to your calendar adds risk and doesn't buy anything.
What if the agent has to use your real calendar?
Sometimes there's no way around it. The agent's job might be your calendar, or your company might not approve anything else. If so, a few things lower the risk.
The first is cutting down what the agent reads. One open-source project puts a small server between the agent and the Google Calendar API, and its list results come back without descriptions or attendee lists. The agent can see that 2pm is taken without seeing who it's with or what it's about.
The same project holds every change until a person approves it. When April, an AI executive assistant, launched on Hacker News, commenters asked for that kind of safe mode, and the founders said one was coming that would limit April to reading and drafting. Another commenter asked for a log of everything it did.
It also helps to stop strangers' invites from landing on their own. Set Google Calendar to add invitations only if the sender is known, and an invite from someone new waits in your email until you accept it.
The log is the part an agent-owned calendar gives you without extra work. Everything the agent booked is on its calendar and everything you booked is on yours, so you never have to work out which of you created a meeting.
Why not share a second Google calendar with the agent?
You can create a separate calendar in your Google account, share it with the agent and call it the agent's calendar. It keeps your own events out of reach, which is better than full access.
The agent is still acting through your account, though. Invites go out from you, replies come back to you, and the prospect it has been emailing for a week gets an invite from a different person. If you run five agents, you have five calendars hanging off one person's account. And the agent has no inbox of its own to receive invites and replies.
Giving each agent a real Google account fixes that, at the cost of a paid Workspace seat per agent.
How does AgentMail give an agent its own calendar?
Every AgentMail inbox comes with a calendar at the same address. Nothing needs to be turned on: the calendar exists from the moment the inbox does, and it is deleted with the inbox.
Because the inbox and the calendar share an address, the agent has one identity. It emails the prospect, books the call and sends the invite from the address the prospect already knows. When the prospect accepts, their reply lands on the event and the agent gets a calendar.event.responded webhook. Invites that people send the agent show up on its calendar automatically, and it can accept, decline or reply tentative.
Four details matter here:
- An emailed invite only goes on the agent's calendar if the email passed sender authentication and came from the event's organizer. Forwarded invites, and cancellations from anyone other than the organizer, are ignored.
- Receive allow and block lists apply to invites the same way they apply to email, so you can limit who can put anything on the agent's calendar.
- API keys can be scoped to calendar permissions, so an agent can read its own calendar without being allowed to delete events.
- You can open the agent's calendar in the AgentMail console and see its week the way you'd check a teammate's.
To set this up, create an inbox. The calendar is already there.
