Blog

Starting in early 2024, Google began silently enabling a set of generative AI features across Gmail for Workspace subscribers. The most visible addition is "Help me write" — a prompt-driven tool that drafts a full email from a short instruction like "Decline the meeting and suggest next Tuesday." Behind the scenes, Google also retrained Smart Compose, Smart Reply, and the spam classifier on newer large-language models. For developers who rely on Gmail as a testing ground for email automation, security analysis, or integration projects, these changes introduce both new capabilities and fresh constraints.

Under the Hood: How Gmail's New AI Works

The core engine for "Help me write" and the improved summarization (now visible on long threads) is a variant of Gemini, Google's family of multimodal models. Unlike the older Smart Reply, which used a sequence-to-sequence model trained only on email, the current system can incorporate calendar context, previous threads, and even attached documents. When you click the pen icon in Gmail's compose window, the browser sends the prompt along with the thread history to a dedicated API endpoint. The response is streamed back token by token.

Google claims that the AI does not use your email content to train the model for other users — a statement that applies to Workspace accounts. Free Gmail users may have different data handling policies, though Google recently updated its privacy whitepaper to clarify that AI features are opt-in for non-enterprise accounts. As a developer, you can see this distinction in the Gmail API scopes: the new gmail.ai.write scope is required for programmatic access to the drafting feature, and it is currently only available for Workspace developers in the allowlist.

Key Features at a Glance

• Help me write — Generate, refine, or rephrase emails from natural language commands. Supports tone adjustments (formal, casual, polite).
• Contextual summarization — Long thread collapse with a one-paragraph AI summary at the top. The summary is not editable, but you can expand the original thread.
• Dynamic Smart Reply — Offers three response options that adapt to the conversation history, not just the latest message. Now includes short questions and actionable phrases.
• Search enhancement — Natural language queries like "find the budget spreadsheet from last month" now return ranked results, though the underlying search index remains unchanged.

Security and Privacy Implications for Developers

From a cybersecurity perspective, the biggest change is the addition of a new attack surface: the AI prompt. If an attacker can inject text into the thread that the model reads, they might influence the generated response — a form of prompt injection. Google has implemented input sanitization on the server side, but developers building third-party integrations should treat any AI-generated text as untrusted. Always validate links, attachments, and code snippets produced by the AI before sending them to users.

Another concern is data retention. When you use the Gmail API to read threads and then call the AI drafting endpoint, the thread content is processed by Gemini's servers. For compliance with regulations like GDPR or HIPAA, you may need to disable AI features for certain mailboxes. The Gmail API now includes a disableAiFeatures parameter in the users.settings resource — test this in your staging environment before rolling out to production.

Practical Tips for Testing in Your Lab

If you maintain a local testing environment with disposable Gmail accounts, here is how to prepare for the AI changes:

1. Enable the "AI features" toggle under Gmail settings → General → Experimental. Note that some features are region-locked. Use a US-based VPN if your test accounts are outside the supported regions.
2. Create a dedicated test user with Workspace access (a free trial works). The new AI endpoints are not available for plain Gmail addresses yet.
3. Use the Gmail API Explorer to call users.drafts.create with the aiPrompt field. Observe the response format — it includes an aiMetadata object with model version and confidence score.
4. Monitor rate limits: the AI endpoint currently allows 60 requests per minute per user, but that quota is separate from the standard Gmail API quota.

What This Means for Email Automation

Existing scripts that generate email templates or auto-reply logic can now offload complexity to the AI — but at a cost. Each AI-generated email incurs a small fee if you exceed the free tier (for Workspace accounts, the first 500 requests per day are free). More importantly, the responses are non-deterministic. A script that relies on predictable output — such as extracting a verification code — should not use the AI drafting feature. Use the traditional drafts.create method for structured emails.

For security testing, consider fuzzing the AI prompt field in your controlled environment. Send subject lines with embedded SQL patterns, shell commands, or markdown injection. Google's filters are aggressive, but you may discover edge cases that bypass sanitization. Document any findings responsibly under a responsible disclosure program.

Finally, remember that the AI makeover also affects how spam filters work. Google now uses Gemini to analyze email content for phishing attempts, which means messages written in an unusual style or with high emotional pressure are more likely to be flagged. When testing your own email delivery, avoid overly promotional language — it might land in the spam folder even for your own domain.