Google Patents an AI That Fetches One-Time Login Codes From Your Email

Google has filed a patent for a system that uses a generative AI model to automatically find and extract one-time login codes from a user's Gmail inbox and return them to the requesting device. The patent describes a client-server handoff in which the user's device sends an authentication request to Google's servers, which match the request to the relevant email and run a model to decide whether a verification code is present before extracting and returning it. The filing is Google's 35th tracked since May in the "AI agents that act for you" group, and the system would extend autofill beyond today's SMS-based code detection on Android and Chrome to email-based two-factor authentication.

Google Patents an AI That Fetches One-Time Login Codes From Your Email Get the best of each week in your inbox, free → get-weekly Every time you log into a site and have to go hunt down a six-digit code buried in your inbox, that is a small piece of friction Google now wants to eliminate entirely. A newly filed patent describes a system that does the searching for you. What Google's automatic verification code fetch actually does Right now, when a website sends you a one-time login code, you have to stop what you are doing, open your email app, find the right message, read the number, and type it in. That context-switch is annoying at best and a security risk at worst when you mistype or grab the wrong code. Google's patent describes a system where, the moment a website asks you to enter a verification code, your device sends a request to Google's servers. Those servers scan your Gmail inbox, find the email tied to that specific website, and use an AI model to pull out the code. The code comes back to your device automatically, ready to fill in. The AI step is important: rather than a simple keyword search, a generative model reads the email and decides whether the code is actually in there before sending anything. That means fewer false matches and less chance of pulling the wrong number from a different message. How Google's model finds and extracts the right code The patent describes a client-server handoff. When a website or app triggers an authentication request asking for a verification code, the user's device the client sends a request to a server that has access to the user's communications account, in this case Gmail. The server then identifies which email in the inbox is associated with the resource the user is trying to access. "Resource" here means the specific website or service asking for the code, so the system has to match the incoming request to the right email sender or subject matter. Once the candidate message is found, the server runs it through a model the patent specifically mentions a generative model, meaning something in the class of large language models that does two things: - Decides whether the message actually contains a verification code - If yes, extracts and returns that code The output comes back to the client device only when the model is confident the code is present. That conditional check is the key architectural detail: the system is not just doing a regex search for strings of digits. It is asking the model to reason about whether what it found is the code being requested. What this means for logging in on Android and Chrome For everyday users, the practical payoff is autofill that works reliably across more situations than today's SMS-based code detection. Android and Chrome already autofill SMS codes on many sites, but email-based codes are largely left to manual copy-paste. This patent would extend that convenience to email. Google keeps filing on inbox-automation and on-device AI https://patentlyze.com/google/ across its product lines, and this fits that pattern squarely. If this system ships inside Gmail or Chrome, websites that still rely on email-based two-factor authentication a large portion of the web become meaningfully easier to use without asking site operators to change anything. That makes this Google's 35th filing we've tracked since May in our AI agents that act for you https://patentlyze.com/watchlist/ai-agents-that-act-for-you/ group, which also covers searching streaming apps by voice https://patentlyze.com/patent/google-parallel-audio-query-processing-devices/ and decoding spoken account numbers https://patentlyze.com/patent/google-ai-voice-bot-understands-alphanumeric-ids/ . Claim 1 covers any method that receives a request, finds a message in a communications account, runs a model against that message, and sends back a code. Nothing in the claim locks it to a particular email service, operating system, or type of model. That is a very wide net. In practice, that breadth means any third-party app, browser extension, or password manager that scans a linked inbox with an AI model to fetch a login code would land inside this claim's territory. The claim does not require the system to be built into a phone or bundled with a specific product, so the reach extends well beyond any one platform. The most defensible piece of the claim is its conditional structure: the system only returns a code when the model signals it actually found one. That specificity gives the claim a concrete hook, and it may be what determines whether this holds up against prior art during examination. There are more where this came from We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week. The drawings 3 drawing sheets from US 2026/0281123 A1 · click any drawing to enlarge Want this weekly breakdown for a company we don't cover? Patentlyze Pro → https://patentlyze.com/pro/?src=post Source. Full patent text and figures from the official USPTO publication PDF https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20260281123 .