Google is testing a setting for its Gemini app on the Mac that would let the AI assistant read, create, change and delete files anywhere on the computer, work inside apps such as Mail, Safari and Messages, and browse the web. The setting is hidden and unfinished. It was spotted by TestingCatalog and reported by BleepingComputer, and Google has not said when it will be released. Nothing has changed on anyone’s Mac today. But the direction is clear, and it is easier to think this through now than on the day the switch appears.
What is being offered
The appeal is real. An assistant that can find the file, fill in the form, tidy the folder and send the email is far more useful than one that can only talk. Google is not alone here either. Other AI companies already offer assistants that can work on your computer, and BleepingComputer compares Google’s plan to one of them.
The setting is called “additional sandbox options.” A sandbox is the set of walls that keeps a program inside its own area of the computer. More options, in this case, means fewer walls. According to the wording found in the app, Gemini may then act “without asking for your permission first.” It would still stop and ask before buying something, moving money, opening an account, accepting legal terms or changing personal information.
Why this is a security story
One of the oldest rules in computer security is that a program should have only the access it needs to do its job. Full access to everything is the opposite of that rule, and three things follow from it.
Mistakes get bigger. An assistant that can delete files anywhere can delete the wrong ones. No attacker is needed for that, only a misunderstood request.
Hidden instructions become dangerous. An assistant that reads web pages and email reads whatever is written there, including text planted for it to find. Researchers call this prompt injection, and it is a known weakness of AI assistants in general. One that can read your files and also send mail is a much bigger prize for that trick than one that can only chat.
The safety list has gaps. As reported, the confirmations cover money, accounts and legal terms. The list does not mention deleting a file or sending a message. That may change before release, and it is the first thing I would check when the feature arrives.
Apple, meanwhile, is reported to be considering limits on how AI assistants reach personal files on a Mac. When the company that makes the computer and the company that makes the assistant are pulling in different directions, the question is not settled yet.
What you can do about it
- Leave it off until you have a job for it. From what has been reported, this is something you turn on, not something that arrives switched on. Wait until there is a task that needs it.
- Share a folder, not the whole Mac. If the assistant only needs your project folder, give it that folder. Tax returns and family photos do not need to be in reach.
- Keep the confirmations, and read them. A prompt you click through without reading protects nothing.
- Try it in a separate user account first. A Mac lets you add a second user with none of your documents in it. That is a safe place to see how an assistant behaves.
- Keep a backup that is not connected to your computer. It covers you whether a file is lost to an attacker or to an over-eager assistant. Ransomwear.org explains how ransomware works and how to guard against it.
None of this means the feature is a bad idea. It means it is a decision, and one worth making on purpose instead of by clicking Allow.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
