Issue 4 - An AI is now reading your Gmail
Welcome back to Inbox Detox. This month we’ve got AI quietly reading your inbox, a real win against email tracking, a breach worth checking, and a novel type of new email scam. Here’s what caught our eye.
Gmail’s AI is reading your email now
Gmail’s new AI layer is now switched on by default. It reads your emails to summarise threads, draft replies, and pull out your to-dos.
Convenient right? But it also means an AI now goes through every email you get.
Google said publicly that it won’t use your emails to train its Gemini AI models, but with the other AI companies constantly nipping at their heels, I’m not sure how long this will last. To Google, Gmail must look like an extremely cheap source of a huge amount of training data.
If (like me) you’d rather opt out, it’s in Gmail’s settings under “Smart Features”.
Plus, how are Gmail protecting against prompt injection?
I also worry that allowing AI to read and draft emails opens up a huge attack space to hackers and scammers. Our emails are historically a private space for our most sensitive data; bank information, one-time login codes, even private notes we send to ourselves.
Should we be allowing access to these to AI?
We’ve seen again and again how information can be misused or exposed by AI via clever prompt-injections, and it’s not difficult to imagine that a well crafted email could hide hidden instructions to an AI (and I posted a small example on X recently).
People are being quietly encouraged to give AI more and more access to their private information, and I don’t think that’s a very good idea. AI is a useful tool, but never give it more access than it needs to do its job, and probably don’t let it draft emails for you.
Europe says tracking your opens needs consent
More good news about tracking pixels!
To follow up on last month’s email, Italy has followed France by saying that explicit consent is required to track email opens.
It only covers people in those countries for now. But it’s a big shift. Regulators are starting to treat open tracking like cookies: something you opt into, not something done to you by default.
I expect to see more EU countries following suit in the coming months.
A huge breach hit the US military, and there’s a takeaway for all of us
Attackers spent nine months inside a US Defense Department system and walked off with records on 2.76 million people: Social Security numbers, dates of birth, and contact details. It was confirmed at the start of October.
Even if that one’s not about you, it’s a reminder of how these things work. Your details sit in dozens of databases you’ve long forgotten about, and when one leaks, your email address is usually in the pile. That’s the fuel for the spam and phishing that turns up in your inbox months later.
I must confess, I’ve had an ulterior motive for writing about data-breaches over the last few months! As you might have seen we released a new feature that will notify you if you’re seen in any breaches. We don’t see this problem getting any better, so hope it’s a small way we can help. Check the bottom of this issue for more details on the new feature.
The scam hiding in a QR code
There’s a fast-growing email scam called “quishing” (aka QR-phishing).
Usually phishing emails pretend to look like an email you expect, such as one from your bank, and then try to link you to their website where they can get you to enter your real bank details.
These are easy for us to defend against with our Spam Blocker. We simply check to see if links lead to where they say they will.
Quishing emails swap the link for a QR code.
So you get an email, maybe a fake parcel notice or a password reset, with a QR code to scan. You point your phone at it and you land on a convincing fake site built to grab your login details.
QR codes are the perfect hiding place. You can’t hover over one to check where it goes, and most email filters can’t read inside the image either.
While we figure out how to deal with these in the Spam Blocker, my advice is to never scan a QR code from an email you weren’t expecting, however correct it looks!
New From Us
Find out who’s leaked your email
Here’s what we’ve been building to help with breaches. Our new feature Breach Detection checks every email address on your account against the biggest known list of hacked sites, and tells you exactly which ones have exposed your details. No more guessing where you’re at risk, so you can change a password, lock things down, or finally ditch that old account you no longer need.
That’s your detox for this month. Stay ruthless with that inbox, and we’ll see you in November.
Founder of Leave Me Alone
