Share with your CISO
Google is wiring Gemini directly into Chrome’s autofill engine, letting the browser pull tracking numbers, flight bookings, hotel reservations, and order details from a user’s Gmail to pre-populate web forms. The feature, called Gemini with Personal Intelligence, rolls out today in the US across desktop, Android, and iOS for users who have opted in. Google says suggestions are encrypted in transit and controllable through Chrome settings, but the architecture means an AI model is now reading employee inboxes to serve browser behavior.
What this means for your business
The employees most likely to enable this without a second thought are also the ones whose Gmail contains the most sensitive operational data, supplier confirmations, travel itineraries, and contract receipts. If your organization runs on Google Workspace, you don’t have a bring-your-own-AI problem here; you have a built-in-AI problem, because the surface area just expanded without a procurement conversation. Whether this story is about you depends almost entirely on whether your acceptable-use policy covers browser-native AI features or only third-party tools employees install themselves.
Google’s encryption claim deserves scrutiny without dismissing it outright. “Encrypted suggestions” describes the data in motion, not the model’s access to the underlying email content required to generate those suggestions. Gemini has to read the inbox before it can surface the tracking number, and that read happens at the application layer before any encryption of the autofill suggestion kicks in. The relevant question for a CISO isn’t whether the suggestion is encrypted on its way to the form field; it’s what data the model ingests, retains, or could expose if the feature misbehaves or is manipulated by a malicious form.
Browser policy is the actual control point here, not user settings. Chrome’s enterprise management console lets IT restrict or disable features like this at the organizational level, and that’s the lever worth checking before the next all-hands on AI governance. If your current browser policy was written before Gemini was a browser feature rather than a standalone product, it almost certainly has a gap. The decision this reframes isn’t whether to trust Google’s encryption, it’s whether your browser management posture is scoped to the product Google shipped in 2024 or the one running in employees’ hands today.
Based on reporting from Chrome’s enhanced autofill can now pull info from Gmail to help you fill out forms, originally published 2026-10-28 13:00:00.
