Why email encryption matters more in the age of AI

AI is now part of email. Assistants summarise threads, draft replies and act on messages, and some can be connected to a mailbox and given permission to send. At the same time, criminals use AI to write phishing emails without the mistakes people used to spot. End-to-end encryption with OpenPGP keeps the content of a message readable only by the people it was sent to, so it stays out of reach of any service, assistant or intruder that can read the mailbox but does not hold the key.

AI is reading more of our mail

The large mail platforms have built AI into the inbox, each with stated limits:

• Google says Gemini in Workspace can draw on the Gmail messages a user can access to answer that user's requests, and that Workspace content is not used to train models outside the organisation without permission. Google also says it does not train its foundation models on personal emails.
• Microsoft says Microsoft 365 Copilot works across the emails, chats and documents a user can access, and that this data is not used to train its foundation models.
• Apple says Mail can summarise emails and threads with Apple Intelligence, mostly on the device, and that larger requests go to its Private Cloud Compute service, which it says does not store the data or make it accessible to Apple.
• ChatGPT and Claude can be connected to a Gmail or Outlook mailbox and act in it, and ask for approval before sending by default.

These are reasonable designs with published safeguards. The practical point is wider than any one company: more software now reads mailboxes on people's behalf, and every connection is another place where the content of your mail is processed.

New risks that come with it

Instructions hidden in email

An AI assistant that reads your mail also reads mail from strangers. Prompt injection is the top risk in the Open Worldwide Application Security Project's (OWASP) 2025 list for AI applications: text written to look like an instruction, hidden in content the AI reads, such as an email. The UK National Cyber Security Centre (NCSC) says language models cannot reliably tell instructions from data, that the problem may never be fully fixed, and that an AI reading email from outside the organisation should not have powerful tools.

This is not theoretical. In June 2025 Microsoft fixed a critical flaw in Microsoft 365 Copilot, CVE-2025-32711, which it described as AI command injection that could disclose information. Microsoft listed it as not exploited, and no customer action was needed.

Phishing without the giveaways

The NCSC says AI makes phishing more convincing and removes the spelling and grammar mistakes that used to give scams away, and it expects AI to increase the frequency and intensity of cyber threats up to 2027. The FBI warns that criminals use AI-written messages, fake identity images, cloned voices and deepfake video. A message that reads perfectly is no longer a sign it is genuine.

What encryption changes

With OpenPGP, a message is encrypted on the sender's computer to the recipient's public key, and only the recipient's secret key can decrypt it. Every copy on every server is scrambled text. In Mozilla's words, only the sender and the recipients can read the contents.

For AI, that has three consequences:

• Assistants and services that read the mailbox see only scrambled text in encrypted messages. Google, for example, says Gemini cannot act on email encrypted with keys the customer controls.
• A mailbox break-in exposes less. If a password or a connected app is compromised, encrypted conversations stay unreadable.
• Signatures help with impersonation. A signed message proves it came from the holder of the sender's key. When a supplier always signs their mail, an unsigned "new bank details" email stands out, however well it is written.

What encryption does not do

• It does not hide who wrote to whom, or when. Addresses and times stay visible.
• It does not protect a message once you decrypt it. An AI tool you run on your own computer, or malware there, can read what you can read. Decide which tools may see decrypted mail.
• It does not stop prompt injection or phishing on its own. Those still need care: limit what any assistant connected to your mail is allowed to do, keep it from sending without your approval, and check unusual requests by phone.

A sensible approach

1. Encrypt the messages that matter: contracts, identity documents, bank details, legal and medical matters. Our guide to why and how to encrypt your email with OpenPGP explains how.
2. Sign everyday mail, so your correspondents learn to expect your signature.
3. Connect AI tools to your mail deliberately. Give each one the least access it needs. Our help article How to use ChatGPT, Claude and Copilot safely with your email covers what each assistant can reach.
4. Keep your own copy of your mail with standard IMAP, in an open-source app such as Thunderbird, which supports OpenPGP built in.

For an organisation that wants its mail on a server of its own, run by Noiz with two-factor sign-in for every user, ask us about Private Email.

Sources

• Google Workspace, generative AI privacy hub: https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en
• Google Workspace, Gemini for Workspace FAQ: https://knowledge.workspace.google.com/admin/gemini/gemini-for-google-workspace-faq?hl=en
• Google, privacy in Gmail with Gemini (7 April 2026): https://blog.google/products-and-platforms/products/gmail/privacy-in-gmail-with-gemini/
• Microsoft Learn, Microsoft 365 Copilot privacy: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
• Microsoft Security Response Center, CVE-2025-32711: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711
• Apple Support, summarise emails with Apple Intelligence: https://support.apple.com/en-gb/guide/iphone/iph461684497/ios
• Apple Security, Private Cloud Compute: https://security.apple.com/blog/private-cloud-compute/
• OpenAI Help, connecting apps to ChatGPT: https://help.openai.com/en/articles/11487775
• Anthropic, Google Workspace connectors: https://support.claude.com/en/articles/10166901-use-google-workspace-connectors
• OWASP, LLM01 prompt injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• NCSC, prompt injection is not SQL injection (December 2025): https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
• NCSC, the near-term impact of AI on the cyber threat (January 2024): https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat
• NCSC, impact of AI on cyber threat from now to 2027 (May 2025): https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
• FBI IC3, criminals use generative AI to facilitate fraud (3 December 2024): https://www.ic3.gov/PSA/2024/PSA241203
• Mozilla Support, introduction to end-to-end encryption in Thunderbird: https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.