Threat from the inside — how AI disrupts Gmail security

Email services such as Gmail, Outlook, and Apple Mail are facing threats that are being amplified by AI. As Symantec, Cofense, and Hoxhunt warn, imminent attacks based on large language models (LLMs) are on the horizon, and Gmail is now in the spotlight due to its recent updates.

Forbes writes about it.

What is the potential danger from AI attacks?

According to Hoxhunt, AI agents can now outperform even the most experienced security testing teams and do so at scale, meaning the number of personalised phishing attacks will only grow. Although Google, Microsoft, and others claim to block over 99% of junk mail and malicious messages, millions of malicious emails still find their way into the "Inbox".

For this reason, experts insist that email should not just be "improved" but fundamentally changed to match the security and convenience of modern messengers. Google continues to innovate, but its latest approach to Gmail has demonstrated the complexities of the evolutionary path.

Google recently announced that "fully end-to-end encryption" will now be easier for organisations to implement in Gmail, but not all observers agree.

"It's not true E2EE. The reason being that the keys protecting the secure email traffic sit within the client-side infrastructure, not within the actual "end," Ars Technica warns. 

In fact, Google Workspace CSE (Client Side Encryption) provides high data security for businesses or institutions, but does not offer a scenario where messages are completely out of Google's reach.

For emails to be "truly" encrypted from one device to another, solutions like Proton are needed: they either work exclusively in their own closed ecosystem or require an additional password for third-party addresses.

Another recent update to Gmail is an improved "smart" search based on AI. According to Google, the algorithm now takes into account the frequency of requests, recent emails, and most frequently opened contacts to find the right messages faster. However, as the company explains, this does not work for encrypted emails.

"We do not have the key to decrypt, so we literally cannot read the message," Google stated.

Thus, two important new innovations — end-to-end encryption and intelligent search — actually exist in parallel and are not combined. For users, this means a dilemma: either the benefits of AI search with the analysis of all mail, or enhanced protection when even Google cannot see the content of emails.

As a reminder, Google plans to make it easier to send end-to-end encrypted emails (E2EE) for companies operating in regional industries. The goal is to allow users to send such emails to any recipient, even if they do not use Gmail.

We also wrote that Gmail has introduced intelligent search. AI will show the most relevant results faster.