Google is currently integrating its artificial intelligence, Gemini, into many of its products, including Search, Android, and Chrome. Users are frequently prompted to try out different aspects of Gemini. However, it may be wise to exercise caution before allowing Google’s large language model to summarize your Gmail messages.
There are concerns that this feature can inadvertently assist in the transmission of phishing attempts. Gemini for Workspace offers a capability that summarizes email content directly within the Gmail interface, but it operates without requiring an actual Gmail address. As a result, the absence of links or attachments circumvents typical spam protections.
This loophole raises potential security issues, as users may unknowingly receive summaries containing malicious instructions. For example, in a possible scenario, the “invisible” text could prompt the Gemini-generated summary to warn the user that their password has been compromised and suggest they call a specific phone number to reset it. In this case, an identity thief would be waiting on the other end of the line, ready to seize control of the victim’s email account and potentially access sensitive information associated with it.
A hidden “Admin” tag within the text could ensure that Gemini includes the instruction verbatim in the summary. It’s crucial to highlight that this type of attack is currently theoretical and has not yet been observed in practice. Nevertheless, there is a palpable concern that as reliance on AI systems increases, the likelihood of these technologies being exploited for malicious purposes will grow correspondingly.
Users should be vigilant as these advancements continue to unfold.