Issue 3 - Most phishing is now written by AI
Welcome back. August was the month the EU started cracking down on AI-made content, just at the right time, as we can now see that AI is writing the majority of all phishing emails!
Also this month: some genuinely useful news from Microsoft and Google. Plus something new from us at the end, with some discounts!
Most phishing is now written by AI
This one has been building all year rather than breaking this month, but the numbers are quite horrifying. Latest threat research puts AI behind 86% of phishing attacks, with calendar-invite phishing up 49%.
The FBI has also been warning about subscription services for criminals that use AI-generated lures, ready-made campaign templates, and dashboards to track their victims. Scamming is becoming a software product now.
In my opinion, humans are still a very bad judge of what constitutes a phishing email. So a good spam blocker has never been more important. I’m super pleased with the progress of our own Spam Blocker (which is trained to block phishing emails), and we’ll continue to try to address the threats of AI and make our inboxes safer.
AI-made content now has to say so in the EU
Since 2 August, new EU AI Act transparency rules are in force. AI systems that generate text, images, audio, or video have to mark their output as AI-made, and deepfakes have to be visibly labelled.
Why this matters for your inbox: we hope this will give mail providers and spam filters something solid to check for. AI-written marketing fluff should become something you can filter out, not just something you can smell.
Law-breakers won’t be labelling their work, of course. More on them in a moment.
P.S. I’ve actually labeled which part of this email was handled by AI (see the disclaimer at the bottom).
Data breaches are on track for a record year
If it feels like you get a “your data was involved in an incident” email every other week now, it’s not your imagination. The Identity Theft Resource Center counted 1,803 breaches in the first half of 2026, putting this year on pace to break the all-time record.
The number that really stings: 471 million breach notices went out in just six months. That’s almost double the number from last year already.
Worth two minutes: search your address on Have I Been Pwned to see where it’s already turned up. And our Private Emails let you give every service a different alias, so one leak doesn’t expose the address everything else depends on.
I think this problem is only going to grow, and we’re in a good position to help you spot and contain these sort of leaks. If there’s something you wish existed, hit reply and tell us.
Outlook finally puts all your accounts in one inbox
Rolling out through August: the new Outlook for Windows and Outlook on the web are getting a unified “All Accounts” inbox, so you can stop clicking between mailboxes to find out where that one email went.
If you juggle several accounts like me, this is a real quality-of-life win. It’s also exactly why we built Leave Me Alone to work across all your accounts at once. One inbox is only calmer if all of them are.
Google Calendar can now block invite spam
Spam invites are a sneaky trick, and difficult for us to protect you against. Spammers discovered that sending an event invite to a Gmail address causes it to appear directly in your calendar without you even needing to open the email! Google had to change some options last year to improve this, but it’s still not perfect.
Good news though, from 18 August Google Calendar is rolling out blocking for invites from specific Google accounts, and blocking a sender in Gmail covers everyone else. It’s a small change that closes this genuinely annoying loophole.
I’m not completely convinced that this will solve the problem though, so we’re looking at ways the Spam Blocker can help with attacks like this.
New From Us
We have partners now, and they come with deals!
We’ve started partnering with privacy-first products we actually use, starting with Ente, an end-to-end encrypted photos app, and Addy.io, an app that helps keep your real email address private.
Right now you can get 25% off your first year of Ente or Addy.io on any plan. You’ll find the coupon, and every future deal, on our new partners page.
We also wrote a blog post about Ente, which you can read here.
That’s your lot for August. If your inbox is starting to feel more machine-written than human, you know where to find us.
See you next month,
Founder of Leave Me Alone
Here’s my AI disclaimer; the contents of this email have been researched by Claude and then written and edited by me (James). The images included are generated by AI. You can see details about our AI use on our Ethics page here.
