You know the rules by now. Do not click the link. Do not open the attachment. Look twice at who really sent it.
Those rules have kept a lot of people safe for a lot of years. In August 2026, Gareth Heyes, a security researcher at PortSwigger, published work that goes around all of them.
He built an email that does its damage the moment you open it. No link to click. Nothing to download. Nothing that looks even slightly wrong. Just a message, sitting there, looking like every other message in your inbox.
Then he tried it against the email programs most people actually use, including Outlook, Gmail, Yahoo Mail, and AOL Mail. It worked.
What the research was able to do
Three things, and it is worth taking them one at a time.
An email recorded what someone typed. Not a virus on the computer. Not a program installed by mistake. Just an open email, quietly noting each letter as it went in. Put a convincing sign-in box in front of that, and a password walks straight out the door.
An email stole a sign-in link. You know the kind: "click here to sign in," and it lets you in without a password. One message reached across and read the link sitting inside another, then handed it to a stranger. Whoever holds that link holds the account.
An email rearranged the mail program itself. Buttons that were not where they appeared to be. A click meant for one thing landing on another. In one demonstration an entire inbox was repainted, and the person looking at it had no way to tell.
Read that list again and notice what is missing from it. Nobody clicked anything. Nobody was careless. The habits you have built up over twenty years, the pause before clicking, the second look at the sender's name, would not have caught any of it.
That is what makes this research worth your attention, and worth ours.
Why the browser is where this bites
It comes down to one quiet difference in how your mail gets put on screen.
When you read email in a web browser, the message and the program showing it are drawn together, on the same page, at the same instant. They share the space. So a message that is up to something is not sealed inside an envelope. It is loose in the room, next to everything else.
That puts the whole weight on one job: cleaning each message before it is shown to you. It sounds simple. It is not, and the research showed several very large, very well funded companies getting it subtly wrong.
We think about that job a great deal, because it is ours too.
We retype every letter
Here is the decision we made early, and it is the reason this research does not land on us.
Imagine a mailroom that does not pass letters through as they arrive. Instead it reads each one, retypes the message onto clean paper, and delivers that. The words come through. The pictures come through. Anything hidden in the original, written in the margins or tucked behind the stamp, does not come through, because nobody ever copied it over.
That is close to what happens to every message before it reaches your screen. It is taken apart, and only the parts a real email needs are allowed into the rebuilt copy.
An email arriving in Patriot Mail can show you words, pictures, colors, and links. That is the entire list.
It cannot carry the hidden instructions the research used. It cannot bring a box you could type into by accident. It cannot reach past its own space on the page to touch our buttons or our menus. It cannot lift itself over the rest of the screen. It cannot watch what you do next.
Every one of those was an ingredient in the attacks above. None of them makes it into your inbox.
Photographs get the same care. When a message wants to show you one, our servers fetch it and hand it over. The sender never sees your computer, and cannot work out where in the world you are reading from.
When this research came out, we did not assume we were fine. We built the attacks from the research into a test message, sent it through our inbox, and watched what came out the other side. The words. Nothing else. Those attacks are now part of the set our inbox is checked against automatically, every time we change the app, so they cannot quietly start working again a year from now.
Three fair questions for any email app
You cannot inspect an email program yourself, and you should not have to. But you can ask three things of any company that wants to open your mail, and none of them requires knowing how any of it works.
Can they explain what they protect you from, in words you can follow? "We take security seriously" is not an explanation. It is a sentence that has never protected anybody.
Has someone independent checked? Patriot Mail passed the CASA Tier 2 security review by TAC Security, the independent examination Google requires before an app is allowed to connect to Gmail. Yahoo has approved us for official sign-in. Neither of those is a badge a company can hand itself.
Do they follow this kind of research, or wait to be told? Gareth Heyes and PortSwigger have a long record of finding this sort of thing and publishing it openly, which is how the rest of us get the chance to fix it. We checked ourselves against the work right away, and wrote this so you would know that we had.
You do not have to move house
This is the part that surprises people most, so it is worth saying plainly.
Changing the app you read your email in does not mean changing your email address.
Your address stays exactly as it is. The mailbox you have had for fifteen or twenty years stays where it is, with everything already inside it. Patriot Mail simply opens it for you, next to your other mailboxes if you have more than one. Nothing moves, nothing is deleted, and your messages are not kept on our servers. If you decide it is not for you, your mailbox is exactly as you left it.
The address is yours, and it stays yours. The program you read it in is only a choice, and it is one you can change in a few minutes on a quiet afternoon.
Patriot Mail is free, shows no ads in your inbox, and works with Gmail, Outlook, Yahoo, iCloud, and most other providers.