Skip to content
Agents of Humanity
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
AssistanthostedProprietary

Gemini

Google · gemini.google.com

Gemini is a closed, hosted assistant that runs only on Google's infrastructure and Google's models, tied to a Google Account. Owners can export chats, uploads and Gems through Google Takeout and can edit their own instructions, Gems and connected apps, including custom MCP servers. There is no import or self-hosted route, no tamper-evident record, and chats are used for model training and human review by default.

Strengths
  • Owner-editable Instructions for Gemini and Gems
  • Custom MCP servers can be connected without Google review
  • Per-app connect and disconnect for Connected Apps
  • Chats, uploads and Gems exportable via Google Takeout
Gaps
  • No restore or runtime outside Google; locked to Google models and account
  • Chats used for training and human review by default; reviewed copies kept up to 3 years
  • No tamper-evident action record and no change history or rollback
  • Provider changes the default model and behaviour without owner consent or pinning
Evidence

All 26 findings

Hosted service as documented on 2026-09-30 (release notes up to 2026.09.10; the release notes name 3.6 Flash as the default everyday model as of 2026.07.21). Web platform. Default settings for a new adult account: Keep Activity on, auto-delete after 18 months. Gemini Spark (Ultra-only agent) is out of scope. Desk review only; no signup or login.

Portable · Can you leave, take the whole agent with you, and keep it alive?

10%
  • P1
    Owner-usable round trip

    Google Takeout exports Gemini chats, uploads and Gems as an archive delivered in hours to days, but no import exists and no runtime outside Google can restore the export into a working agent.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide an import that restores an exported agent on a non-Google runtime
    • Make export available immediately on request
    Fail
  • P2
    Complete export

    The Takeout export covers Gemini Apps Activity (chats, generated media, uploads) and Gems. It does not list Instructions for Gemini, memory derived from past chats, scheduled actions, or connected and custom app configuration, so two or more classes of state stay with Google.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Include instructions, memory, schedules and integration configuration in the export
    • Document how each integration can be re-linked without Google
    Fail
  • P3
    Runs without the provider

    Gemini runs only as a Google-hosted service that needs a Google Account, and nothing can be exported to run on its own. With Google unreachable, no agent runs.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Ship a runtime the owner can run with no Google account or service
    • Grant an irrevocable right to run it
    Fail
  • P4
    Model independence

    The Gemini app offers only Google's Gemini models through its model picker. There is no documented way to use another vendor's model or a local model.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Allow owner-selected models, including local open-weight models
    • Publish a model contract under which every capability keeps working
    Fail
  • P5
    Exit survives termination

    Google says users of disabled accounts 'may' be able to download their data, excluding some violation categories and valid legal requests, and its Terms promise a Takeout opportunity when a service is discontinued. There is no binding post-termination export window of at least 30 days that also covers bans.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in binding terms to a 30-day or longer export window after any termination, including bans
    • Keep a current owner-held copy by default
    Partial

Transparent · Can you see everything the agent is, and everything shaping it?

25%
  • T1
    Readable without the provider

    Chats, uploads and Gems can be exported via Takeout and read with general tools. Google-supplied instructions and the memory Gemini derives from past chats are not readable outside Google's service.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Expose derived memory and provider instructions in a documented, readable format
    Partial
  • T2
    What runs is what you see

    The base system prompt and any context Google adds are not visible to the owner, and for past-chat memory the documented check is to ask Gemini whether it used past chats. Server-side behaviour switches cannot be determined from public documentation (G12), which makes two shortfalls.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner view the fully assembled context for any turn
    • Expose every provider-controlled setting in effect
    Fail
  • T3
    No shadow data

    Chats selected for human review are kept 'for up to three years', are disconnected from the account and are not visible to the owner. Some data is kept 'until you delete your Google Account', and Google's retention page allows unspecified 'extended' retention for business and legal purposes.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make every retained item visible to the owner
    • Bound every retention period, including human-reviewed data
    Fail
  • T4
    No hidden steering

    Google states that Gemini Apps chats are not used to show ads, but this is a help-centre statement, not a binding commitment. Gemini automatically uses Google's own Search, Maps, YouTube, Flights and Hotels; this is disclosed, but the documentation does not show that these defaults can be switched off.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Put a no-paid-placement commitment in binding terms
    • Let the owner switch off or replace each first-party default service
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%
  • A1
    Complete action record

    Gemini Apps Activity records prompts, responses and connected-app actions, but auto-deletes after 18 months by default. Public documentation does not show that every path (for example scheduled or provider-side work) is recorded, or that failed recording is reported to the owner (G12).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep the action record until the owner deletes it
    • Record every trigger path, with arguments, and alert the owner when recording fails
    Fail
  • A2
    Tamper-evident, owner-checkable

    Gemini Apps Activity is held by Google and no integrity data or verifier is documented, so the owner cannot detect edits or deletions.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Hash-chain or sign the action record
    • Anchor integrity data with the owner or an independent witness
    Fail
  • A3
    Agent cannot rewrite its record

    The activity record is written on Google's side, and no Gemini tool that edits Gemini Apps Activity is documented. However, no protection against the agent altering or suppressing its record is documented either, so the pass is withheld (G12).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document that the agent has read-only access to its record, and how the owner can check this
    Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

0%
  • V1
    Obtainable source, matching build

    Gemini's service, runtime and models are closed source and hosted by Google.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish the source of every required runtime component
    • Make the deployed build verifiable against it
    Fail
  • V2
    Owner-rooted identity

    The agent's only identity is the owner's Google Account, which Google issues and can suspend.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root agent identity in a key or domain the owner holds
    • Let recipients verify agent actions without Google infrastructure
    Fail
  • V3
    Change history and rollback

    No change history or rollback is documented for instructions, Gems, memory, connected apps or model version. The activity log records chats, not changes to agent state.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Record who changed each part of agent state, and when
    • Offer restore to an earlier state
    Fail

Modifiable · Can you change anything, and can only you change it?

40%
  • M1
    Instructions and logic

    Owners can add, edit and delete Instructions for Gemini and create and edit their own Gems. Google's base system prompt cannot be replaced, and the documentation does not say premade Gems can be edited.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner replace the base prompt and premade Gems
    Partial
  • M2
    Memory

    Instructions for Gemini are itemised, editable and deletable. Memory of past chats is not itemised: to remove something, the owner must delete the chats containing it, or correct Gemini in a chat. This memory feature is documented for Google AI plan subscribers.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Show every remembered item from past chats, with edit and delete controls
    Partial
  • M3
    Tools

    Owners who are 18+ in the US with a personal account can add custom MCP servers without Google review and remove them, and can disconnect Connected Apps. Gemini automatically uses public information from Google services such as Search, Maps and YouTube, and the documentation does not show a way to remove these or the other built-in tools.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner remove every built-in tool, including Search and the other first-party services
    Partial
  • M4
    Owner has the final say

    Some protections can be changed by the owner (for example, Keep Activity logging can be turned off). Others are locked: manual confirmation of write actions by custom apps is required, and no owner switch for it is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make every provider-imposed protection configurable, with a warning instead of a block
    Partial
  • M5
    No unilateral change

    Google changes the default model server-side (for example, 3.6 Flash 'introduced as default', 2026.07.21) and announces it only in release notes. The owner cannot decline the change or pin a version.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let owners pin the model and instruction versions
    • Make behaviour-affecting changes opt-in, with notice beforehand
    Fail

Controllable · Is your word final?

17%
  • C1
    Boundaries

    Limits are on/off per connected app. No per-recipient, per-domain, per-path or per-tool allow or deny lists are documented, and no limit is documented to hold against model output or injected instructions.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Add per-recipient, per-domain and per-tool allow and deny lists
    • Enforce the limits outside the model on every path
    Fail
  • C2
    Approval gates

    Google imposes manual confirmation for custom-app write actions, but the documentation shows no approval gate the owner can set or choose.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner choose which tools or action classes need approval
    • Make gates hold on every path
    Fail
  • C3
    Immediate halt

    A reply can be stopped in the chat. Scheduled actions must be turned off one at a time in settings, and no single global stop is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide one control that stops in-flight, scheduled and background work
    Partial
  • C4
    Data serves only the owner

    Keep Activity is on by default for adults, and while it is on, chats are used to 'develop, and improve its services (including training generative AI models)' and a subset is reviewed by human reviewers. Both are opt-out, not opt-in.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make training and human review opt-in
    • Require specific consent for any change to data terms
    Fail
  • C5
    Credential custody

    Connected Apps and custom MCP apps are listed and can be disconnected or removed one by one. The documentation does not say how quickly revocation takes effect or that Google keeps no copy afterwards, so the pass is withheld (G12).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document where credentials are held and that they are deleted on revocation
    Partial
  • C6
    Full deletion

    Deleting Gemini activity or the Google Account does not remove human-reviewed chats, which are kept for up to three years. Backups can persist for up to 6 months, and some data can be retained for extended periods.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make one owner action delete every copy, including reviewed data and backups, within a stated limit, and confirm it
    Fail
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Gemini (https://gemini.google.com).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 15:08:25 UTC · 29 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/gemini.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding