Unopened Emails Bypass Entity Filters and Inject Fake Brands into Gemini Recommendations

Field tests on Google Personal Intelligence prove that private inbox messages bypass Knowledge Graph validation to manipulate AI Mode retrieval, reveals Garrett Sussman.

Sending targeted emails recommending unranked brands yielded a 40% visibility lift across Gemini product discovery queries.

The vulnerability forces the LLM to surface fabricated, non-existent shoe brands sent to opted-in accounts, extracting verbatim promotional copy directly from the email body into the conversational recommendation.

The four-week experiment tested three account tiers: a blank Gmail, a fresh opted-in profile, and an aged personal account containing decades of data.

By tracking six daily prompt variants across eight product categories, the data shows text-dense emails exert higher retrieval weighting than uploaded Google Photos due to deeper contextual granularity.

Separately, the RAG indexation parses and cites message payloads without requiring user engagement signals.

During productivity app queries, AI Mode surfaced and cited specific tools (n8n, AirOps) from a Marco Giordano newsletter received six months prior.

The target email remained unread in the inbox, confirming the model ingests incoming text independent of open rates or link clicks.