Google is testing a major expansion of Gemini on macOS that could transform the assistant from a chatbot into something much closer to an autonomous desktop agent.
Hidden settings discovered in the Gemini Desktop app suggest users may eventually be able to give the AI access to files across their Mac, allow it to interact with applications such as Mail, Safari and Messages, browse the web and perform some actions without requesting permission each time. The capability is not currently available, and Google has not officially announced when — or whether — it will be released.
From Chatbot to Desktop Agent
The experimental feature appears under a hidden setting called “Additional sandbox options.” According to text found in the application, enabling these permissions would expand both what Gemini can access and what it can do on a Mac.
One of the most consequential options would give Gemini access beyond directories users have explicitly connected to the assistant. Depending on the permissions granted, the AI could potentially read, create, modify or delete files anywhere it is allowed to operate.
Gemini could also communicate with native applications and perform actions through them. Combined with web access, that creates the foundation for workflows in which a user gives the assistant a goal rather than manually moving information between applications.
Instead of asking Gemini how to organize a collection of documents, for example, an agent with sufficient permissions could potentially inspect the files and perform the organization itself.
Google Is Keeping Confirmation for Sensitive Actions
Full desktop access would not mean completely unrestricted autonomy. The hidden interface indicates that Gemini would continue asking users before performing particularly sensitive actions.
Those include purchasing products, transferring money, creating online accounts, accepting legal agreements or modifying sensitive personal information.
That distinction reflects one of the central design challenges facing agentic AI. Requiring confirmation for every action makes autonomous assistants cumbersome, but allowing an agent to operate freely increases the consequences when it makes a mistake or encounters malicious instructions.
The emerging compromise is selective autonomy: routine actions can happen automatically while higher-risk decisions remain behind explicit human approval.
More Capability Means a Larger Security Boundary
Giving an AI assistant broad desktop access fundamentally changes its security profile.
A conventional chatbot primarily handles information provided directly through its interface. A desktop agent can potentially interact with documents, email, browser sessions and applications containing sensitive information.
That means an attack against the agent could potentially inherit some of those capabilities.
The industry has already seen examples of prompt injection and other techniques manipulating AI agents into performing unintended actions. Google itself has previously addressed vulnerabilities where malicious content could influence Gemini-connected systems, including an issue involving crafted Google Calendar invitations.
The security problem therefore extends beyond whether Gemini correctly understands the user. The agent must also distinguish legitimate instructions from potentially hostile information encountered while browsing websites, reading documents or interacting with other applications.
The Operating System Is Becoming the Next AI Battleground
Google is not alone in pursuing deeper computer control. AI companies increasingly envision assistants that can work across applications instead of remaining inside isolated chat windows.
For users, the appeal is obvious. An agent that can only explain how to complete a task saves some time; an agent that can actually complete the task can change how people interact with computers entirely.
But the same transition moves AI assistants closer to the privileged software traditionally treated as part of an operating system’s security boundary.
Google’s experimental Gemini permissions capture that trade-off clearly. The assistant becomes dramatically more useful when it can see files, communicate with applications and act independently — but every additional permission also increases what could go wrong if the agent is manipulated or compromised.
The next generation of AI assistants will therefore be judged by more than how intelligently they answer questions.Their security may depend on how carefully they handle the enormous amount of trust required to act on our computers for us.