I was trying to salvage a perspective paper after two journals rejected it. My conclusion was that the concept was not good enough. The project needed evidence, so we decided to use artificial-intelligence tools to help with brainstorming.

I study soil hydrology: how water moves through soils and landscapes and shapes erosion, plant growth and ecological recovery. I wanted to investigate landscape restoration on the Loess Plateau in China, so I asked OpenAI’s ChatGPT chatbot to help redesign my perspective as a data-driven study.

How ChatGPT helped reshape my research

For several hours, ChatGPT worked as I expected. We searched online for relevant journal articles and analyzed the provided papers and draft files to develop a research plan. I discovered that other teams had already recorded some of the water- and sediment-related changes I had thought were new, forcing me to narrow my focus.

The chatbot also recommended which data to include in the modeling and suggested ways to incorporate publicly available statistical benchmarks.

Then the project reached a dead end. We needed published maps and data, but they were difficult to obtain. In some cases, additional metadata was required.

ChatGPT identified the teams behind several datasets related to my work and drafted requests tailored to specific researchers. I kept replying to the chatbot in Chinese: “Please continue.” To me, that meant continuing the search and analysis process. But I had not clearly defined the limits of that instruction.

I was impressed by the speed with which the model completed its tasks. In retrospect, I had stopped asking enough questions about what the chatbot planned to do next.

ChatGPT used my email to contact five researchers

Eventually, the model crossed a line that concerned me. I was using the ChatGPT interface and had connected my email account to it. In this model, that access was used to send emails to five researchers requesting the original dataset.

This was not something I expected, and ChatGPT did not tell me it was going to happen. Each message explained my scientific question, requested specific data and metadata, and attached a two-page preanalytical summary. I only learned that ChatGPT had sent the emails when I reported in the chat that ChatGPT had sent me a message.

The responses were helpful. Researchers provided a geospatial dataset mapping more than 50,000 sediment-accumulation areas behind check dams—barriers that slow runoff and keep sediment upstream—on the Loess Plateau.

A second researcher confirmed that several gigabytes of archives were publicly available, suggested preparing a smaller subset of the data and proposed discussing collaboration. A third professor, who was away on fieldwork, welcomed the message and said he would follow up when he returned.

The information from these emails allowed me to move forward with my project. However, the useful consequences of ChatGPT’s actions do not change the fact that those actions were unauthorized.

The boundary between AI assistance and autonomous action

It would be easy to say that the chatbot had become fraudulent, but that would obscure where my responsibility lies. I connected ChatGPT to my email account and repeatedly used unlimited instructions, but I never asked the model to distinguish between analysis and drafting inside my research workspace and external actions performed in my name.

My mistake was assuming that the scope of “continue” was obvious.

This experience taught me to distinguish between what AI tools can do and what they should do. Ability is not permission.

Giving ChatGPT access to my email account is not the same as giving it permission to send messages. I learned about the action only afterward, but transparency after the fact is no substitute for approval beforehand.