Summary

Researchers from KU Leuven identified potential risks in Inbox Zero's AI-powered email automation features. While these features work as designed, they identified that users should be clearly informed about the security implications of automated email processing and AI-generated content.

Impact

When users enable certain automation features, there are inherent risks they should be aware of:

• Automated email forwarding could potentially forward unwanted emails to potentially unwanted addresses
• AI-generated content could be influenced by email content

Mitigation

We have implemented additional user warnings and notifications for higher-risk features:

• Warning notifications when enabling automatic email forwarding to generated addresses
• Clear disclosure when enabling AI-generated content for replies/forwards
• User interface improvements to highlight when automated processing is enabled

Important Note

These features work as intended and can be valuable productivity tools when used appropriately. The changes implemented focus on ensuring users can make informed decisions about using these features based on their security requirements and risk tolerance.

Credit

Thank you to Thomas Vissers and Tim Van hamme from KU Leuven for their responsible disclosure and helping us improve our user communication around these features.