Jake Kastrenakes of The Verge demonstrated a self-built email client created through a process known as vibecoding to highlight potential security vulnerabilities.

This demonstration underscores a growing tension between the rapid adoption of AI-driven development and the critical need for data privacy. As users grant AI agents broad permissions to read and write emails, they may inadvertently expose sensitive personal and professional information to third-party services.

During an episode of The Vergecast, Kastrenakes showcased the functional capabilities of the tool. However, the demonstration served as a warning about the dangers of granting AI services extensive Gmail permissions. The ability for an AI to access an inbox allows for a high degree of automation, but it also creates a significant attack surface for potential data breaches.

Maor Shlomo, the founder of Base44, echoed these concerns. Shlomo said vibecoding tools are easy to copy and inherently risky. His perspective suggests that the low barrier to entry for creating these applications does not necessarily correlate with a high standard of security implementation.

These discussions gained further traction in a Business Insider report from November 2025 [1]. The report detailed the risks associated with the current trajectory of AI integration within personal communication tools. The ease with which a user can now build a custom client—once a task requiring professional engineering—means that insecure code can be deployed and connected to live data at an unprecedented scale.

Security experts continue to warn that the convenience of AI-managed mailboxes often comes at the cost of traditional security protocols. When an AI tool is granted full access to a Gmail account, any vulnerability in that tool's architecture becomes a direct gateway to the user's entire digital identity.

“Vibecoding tools are easy to copy and risky.”

The rise of 'vibecoding'—where users create software through high-level AI prompting rather than manual coding—democratizes software development but bypasses traditional security audits. By connecting these rapidly iterated tools to sensitive APIs like Gmail, users are shifting the trust model from established software vendors to experimental AI-generated code, increasing the likelihood of systemic privacy leaks.