# The state of agentic email marketing in 2026 Canonical: https://brew.new/blog/state-of-agentic-email-marketing-2026 Author: Thomas Park Published: 2026-11-11 Updated: 2026-11-11 A year ago, "AI in email marketing" mostly meant a button that wrote subject lines. In November 2026 it means something bigger. Agents now touch email in three places: 1. **They operate your email platform.** A marketer asks ChatGPT, Claude or Slack for a campaign, and the agent builds it in the platform. 2. **They send and receive email themselves.** Agents have their own inboxes and reply to people. 3. **They read your email before your customer does.** Gmail, Apple Mail and Outlook summarize, sort and answer questions about the inbox. This post pulls together what the research says about each one, what we've learned building Brew, and what we'd do if we ran an email program today. Every number links to its source, and where a company is reporting on its own product or customers, we say so. ## Marketers are using agents, but few have wired them in The adoption numbers are high, though definitions are loose. - HubSpot says more than 85% of the 1,754 marketers it surveyed work in departments that [use AI agents](https://blog.hubspot.com/marketing/ai-maturity). The page doesn't define "agent," so that likely includes chat assistants. - Salesforce's [State of Marketing](https://www.salesforce.com/news/stories/state-of-marketing-2026/), a survey of 4,450 marketing leaders, found 81% would trust AI to respond to customers but are held back by disjointed or irrelevant data. - Validity found that only 12% of organizations rate their AI maturity as "integrated," and the top barrier to scaling AI is system integration, at 34% ([press release](https://www.prnewswire.com/news-releases/new-validity-research-reveals-how-ai-integration-is-reshaping-email-marketing-performance-302741555.html)). All three are vendors reporting on surveys they ran. The pattern is still clear. Using an AI tool is common. Letting an agent work directly in the systems that hold your brand, your contacts and your send history is not, and that's the part that pays off. ## Agents now operate email platforms ### MCP became the standard way in The Model Context Protocol, which lets an assistant use another product's tools, moved to the Linux Foundation's Agentic AI Foundation in December 2025. At the time it had more than 97 million monthly SDK downloads and support in ChatGPT, Claude, Cursor, Gemini, Copilot and VS Code ([MCP blog](https://blog.modelcontextprotocol.io/posts/2025-12-09-mcp-joins-agentic-ai-foundation/)). By the July 2026 spec, its main SDKs were near half a billion downloads a month ([MCP blog](https://blog.modelcontextprotocol.io/posts/2026-07-28/)). ### Every major email platform followed - **Klaviyo** said on its November 4 earnings call that more than 70,000 accounts use its MCP server, with usage doubling each quarter and running ahead of its own built-in agent ([transcript](https://www.fool.com/earnings/call-transcripts/2026/11/05/klaviyo-kvyo-q3-2026-earnings-call-transcript/), vendor). - **HubSpot** said customers created more than 22 million CRM records through ChatGPT and Claude connectors in Q3, up 157% on the quarter ([transcript](https://www.fool.com/earnings/call-transcripts/2026/11/05/hubspot-hubs-q3-2026-earnings-call-transcript/), vendor). - **Mailchimp** launched an [app in ChatGPT and Claude](https://investors.intuit.com/news-events/press-releases/detail/1313/intuit-mailchimp-launches-analytics-ai-and-expanded-data-integrations-to-give-brands-conversational-actionable-intelligence) in May for drafting campaigns from a conversation. - **Braze** brought its agent into Claude, ChatGPT and Copilot with [Operator Connect](https://investors.braze.com/news/news-details/2026/Braze-Accelerates-AI-Innovation-Empowering-Marketers-to-Treat-Every-Customer-Like-Their-Only-Customer/default.aspx) in September. We compared how 14 of these servers handle sign-in, writes and sends in [Email platform MCP servers: auth, writes and sends](/blog/esp-mcp-servers-compared). Klaviyo's number is the one to sit with. More of its customers reach it through an outside assistant than through its own agent. Marketers want to work from the assistant they already have open, and they expect the email platform to meet them there. ### Draft first, approve second Look at how these platforms ship agent access and one design choice repeats: - Klaviyo says of its Composer agent that [nothing goes live without approval](https://www.klaviyo.com/newsroom/CRM-agents). - Iterable's MCP server starts [read-only](https://github.com/Iterable/mcp-server), with writes, sends and personal data off until you turn them on. - Customer.io keeps MCP edits to live data and access to sensitive attributes [off by default](https://docs.customer.io/release-notes/). - HubSpot's MCP server can only touch records [the user could already see or edit](https://developers.hubspot.com/changelog/remote-hubspot-mcp-server-is-now-generally-available). The industry has landed on the same answer. Agents draft, people approve anything that reaches customers. ![A table of six email platforms, how agents get in, and the default before a send or write: Klaviyo requires approval before anything goes live, HubSpot limits agents to what the user can already edit, Braze runs under each user's permissions, Customer.io keeps live-data edits off by default, Iterable starts read-only, and Brew asks for confirmation before emailing people and uses a Slack approval card.](/images/blog/agentic-email-approval-defaults.png) *How six email platforms let an assistant in. Sources are linked above.* ## Agents send and receive email too Agents are getting their own addresses. AgentMail raised a $6 million seed in March to give agents inboxes through an API ([AgentMail](https://www.agentmail.to/blog/agentmail-seed-launch)), and Resend launched [Inboxes](https://resend.com/blog/announcing-inboxes) in October, shared between people and agents, recommending that teams start the agent on drafts and labels and widen its permissions as trust builds. The rules for what those agents send haven't changed. Gmail's [sender guidelines](https://support.google.com/a/answer/81126) still ask bulk senders to authenticate, offer one-click unsubscribe and keep spam complaints below 0.3%, with a target under 0.1%. They say nothing about whether a person or a model wrote the email. We covered what that means in practice in [What still applies when an agent sends your email](/blog/agent-email-deliverability). Volume isn't a strategy, either. One outreach company's own data on 1.29 million AI-written cold emails found that 0.70% got a reply from a real person and 0.24% an interested one ([Sales.co](https://sales.co/research/ai-in-sales-statistics), vendor data). Email that people asked for, sent to people who opted in, is still the part of email that works. ## Agents read your email first This is the change most marketers feel already. - In January, Gmail made AI summaries free for all US users, across a service with about 3 billion users ([Google](https://blog.google/products-and-platforms/products/gmail/gmail-is-entering-the-gemini-era/)). In October, its AI Inbox, which sorts mail into to-dos and topics, reached paid Workspace plans ([Google Workspace Updates](https://workspaceupdates.googleblog.com/2026/10/gmails-ai-inbox-is-rolling-out-to-paid-Workspace-users.html)). - Validity found 55% of US consumers make decisions from an AI summary alone, and only 10% fully trust summaries to represent the email accurately ([press release](https://www.prnewswire.com/news-releases/validity-research-reveals-consumers-let-ai-curate-their-inboxes-while-marketers-struggle-to-keep-up-302785148.html), 1,000 consumers, vendor). - Marketers are adjusting. In Validity's October survey, 72% had changed or planned to change subject lines or preview text because of AI summaries, but only 29% felt well prepared ([via Agile Brand Guide](https://agilebrandguide.com/most-marketers-are-adapting-email-strategies-for-ai-powered-inboxes-but-just-29-feel-well-prepared-ahead-of-holidays-validity-research-finds/), vendor). The summary is now part of your email's design. If the offer, the deadline and the action live in an image or at the bottom, the assistant may miss them, and many readers will act on what it says. Our guide to [writing email for AI summaries](/blog/email-for-ai-readers) covers the layout that holds up. ## Agentic commerce: the receipt is still yours Buying inside an assistant has had a bumpy year. OpenAI ended its in-chat Instant Checkout in March and moved purchases back to retailers' own sites. Walmart had found purchases inside ChatGPT converted at roughly a third of the rate of its own site ([CNBC](https://www.cnbc.com/2026/03/20/open-ai-agentic-shopping-etsy-shopify-walmart-amazon.html)). The commerce protocols that remain agree on one point. Shopify's [agentic storefronts](https://shopify.com/news/agentic-commerce-momentum) keep the merchant as merchant of record, with the customer relationship and the data. Google's [Universal Commerce Protocol](https://blog.google/products/ads-commerce/agentic-commerce-ai-tools-protocol-retailers-platforms/) covers the journey through post-purchase support. For email teams, that means the order confirmation, the shipping update and the review request are still yours to send, even when an agent found the product. Those emails may become the first real contact a customer has with your brand. ## Email is also where agents get attacked An agent that reads email can be told what to do by email. Researchers showed a single crafted email could make Microsoft 365 Copilot leak data with no user action ([EchoLeak, arXiv](https://arxiv.org/abs/2509.10540)). Others used hidden text to plant a fake security warning in Gemini's Gmail summary ([0DIN](https://0din.ai/blog/phishing-for-gemini)). Both were fixed, and the lesson stands. An agent that reads untrusted email shouldn't be able to send, delete or export without someone confirming. ## What we've learned building Brew Brew was built for agents from the start. The same email agent works in the Brew app, in [Slack](/blog/how-to-run-email-campaigns-from-slack-with-approval-before-anything-sends), over [MCP](/blog/brew-mcp) from ChatGPT, Claude or Cursor, and through the API. A few things we've learned along the way: **The first draft starts the conversation.** Over the last 30 days, our email agent handled about four edit requests for every new email or variant it designed. People don't want one perfect generation. They want a fast first draft in their brand and a collaborator for the next four rounds. So we've invested in what an edit reports back and in an editor that behaves like the inbox. **Brand context beats prompt length.** The most reliable way to get on-brand email from an agent is to give it the brand, not a longer prompt. Brew writes an editable [design guide for each brand](/blog/email-design-md) and the agent reads it before every email. When we tested on ten brands we'd never used, [82% of emails came out with real design](/blog/emails-designed-for-your-brand), up from 12%. **Approval has to be built in, not bolted on.** In Slack, anything that reaches real people waits for an approval card only the person who asked can answer. Over MCP, on OAuth and organization connections, a call that emails people or removes contact data comes back as a confirmation request first. Test emails go only to your own team. It's the same answer the rest of the industry reached, and we think it's the right one. **Agents need clear answers more than more tools.** This fall we folded our MCP server down to 89 tools, put the numbers an assistant needs into each result's text, and made errors list every problem at once ([changelog](https://docs.brew.new/changelog/posts/clearer-answers-for-agents-and-code)). An agent that understands one answer makes fewer calls and fewer mistakes. ## What this means for you 1. **Connect your data before you add another agent.** The research is consistent: integration and data quality hold teams back more than model quality does. 2. **Let agents draft, keep people on approval.** Choose platforms where sends to real customers need a person's yes, and where read-only access is possible. 3. **Write for the summary.** Offer, deadline and action in live text near the top. Measure clicks and conversions, not opens. 4. **Own the post-purchase email.** Agents may find the product; you still send the receipt, the update and the follow-up. 5. **Keep reading and acting apart.** An agent that reads your inbox shouldn't send or delete without asking. If you want to try this with your own brand, [connect Brew to your assistant](/blog/brew-mcp) and ask it to draft your next campaign. You'll approve it before anyone sees it.