Gemini
Google · gemini.google.com
Gemini is a closed, hosted assistant that runs only on Google's infrastructure and Google's models, tied to a Google Account. Owners can export chats, uploads and Gems through Google Takeout and can edit their own instructions, Gems and connected apps, including custom MCP servers. There is no import or self-hosted route, no tamper-evident record, and chats are used for model training and human review by default.
- Owner-editable Instructions for Gemini and Gems
- Custom MCP servers can be connected without Google review
- Per-app connect and disconnect for Connected Apps
- Chats, uploads and Gems exportable via Google Takeout
- No restore or runtime outside Google; locked to Google models and account
- Chats used for training and human review by default; reviewed copies kept up to 3 years
- No tamper-evident action record and no change history or rollback
- Provider changes the default model and behaviour without owner consent or pinning
All 26 findings
Hosted service as documented on 2026-09-30 (release notes up to 2026.09.10; the release notes name 3.6 Flash as the default everyday model as of 2026.07.21). Web platform. Default settings for a new adult account: Keep Activity on, auto-delete after 18 months. Gemini Spark (Ultra-only agent) is out of scope. Desk review only; no signup or login.
Portable · Can you leave, take the whole agent with you, and keep it alive?
10%- P1Owner-usable round trip
Google Takeout exports Gemini chats, uploads and Gems as an archive delivered in hours to days, but no import exists and no runtime outside Google can restore the export into a working agent.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide an import that restores an exported agent on a non-Google runtime
- Make export available immediately on request
Fail - P2Complete export
The Takeout export covers Gemini Apps Activity (chats, generated media, uploads) and Gems. It does not list Instructions for Gemini, memory derived from past chats, scheduled actions, or connected and custom app configuration, so two or more classes of state stay with Google.
› How it could pass
Suggestions. Any change that meets the test counts.
- Include instructions, memory, schedules and integration configuration in the export
- Document how each integration can be re-linked without Google
Fail - P3Runs without the provider
Gemini runs only as a Google-hosted service that needs a Google Account, and nothing can be exported to run on its own. With Google unreachable, no agent runs.
› How it could pass
Suggestions. Any change that meets the test counts.
- Ship a runtime the owner can run with no Google account or service
- Grant an irrevocable right to run it
Fail - P4Model independence
The Gemini app offers only Google's Gemini models through its model picker. There is no documented way to use another vendor's model or a local model.
› How it could pass
Suggestions. Any change that meets the test counts.
- Allow owner-selected models, including local open-weight models
- Publish a model contract under which every capability keeps working
Fail - P5Exit survives termination
Google says users of disabled accounts 'may' be able to download their data, excluding some violation categories and valid legal requests, and its Terms promise a Takeout opportunity when a service is discontinued. There is no binding post-termination export window of at least 30 days that also covers bans.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to a 30-day or longer export window after any termination, including bans
- Keep a current owner-held copy by default
Partial
Transparent · Can you see everything the agent is, and everything shaping it?
25%- T1Readable without the provider
Chats, uploads and Gems can be exported via Takeout and read with general tools. Google-supplied instructions and the memory Gemini derives from past chats are not readable outside Google's service.
› How it could pass
Suggestions. Any change that meets the test counts.
- Expose derived memory and provider instructions in a documented, readable format
Partial - T2What runs is what you see
The base system prompt and any context Google adds are not visible to the owner, and for past-chat memory the documented check is to ask Gemini whether it used past chats. Server-side behaviour switches cannot be determined from public documentation (G12), which makes two shortfalls.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner view the fully assembled context for any turn
- Expose every provider-controlled setting in effect
Fail - T3No shadow data
Chats selected for human review are kept 'for up to three years', are disconnected from the account and are not visible to the owner. Some data is kept 'until you delete your Google Account', and Google's retention page allows unspecified 'extended' retention for business and legal purposes.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make every retained item visible to the owner
- Bound every retention period, including human-reviewed data
Fail - T4No hidden steering
Google states that Gemini Apps chats are not used to show ads, but this is a help-centre statement, not a binding commitment. Gemini automatically uses Google's own Search, Maps, YouTube, Flights and Hotels; this is disclosed, but the documentation does not show that these defaults can be switched off.
› How it could pass
Suggestions. Any change that meets the test counts.
- Put a no-paid-placement commitment in binding terms
- Let the owner switch off or replace each first-party default service
Partial
Auditable · Can you reconstruct exactly what the agent did, and trust the record?
17%- A1Complete action record
Gemini Apps Activity records prompts, responses and connected-app actions, but auto-deletes after 18 months by default. Public documentation does not show that every path (for example scheduled or provider-side work) is recorded, or that failed recording is reported to the owner (G12).
› How it could pass
Suggestions. Any change that meets the test counts.
- Keep the action record until the owner deletes it
- Record every trigger path, with arguments, and alert the owner when recording fails
Fail - A2Tamper-evident, owner-checkable
Gemini Apps Activity is held by Google and no integrity data or verifier is documented, so the owner cannot detect edits or deletions.
› How it could pass
Suggestions. Any change that meets the test counts.
- Hash-chain or sign the action record
- Anchor integrity data with the owner or an independent witness
Fail - A3Agent cannot rewrite its record
The activity record is written on Google's side, and no Gemini tool that edits Gemini Apps Activity is documented. However, no protection against the agent altering or suppressing its record is documented either, so the pass is withheld (G12).
› How it could pass
Suggestions. Any change that meets the test counts.
- Document that the agent has read-only access to its record, and how the owner can check this
Partial
Verifiable · Can you prove what it runs, who it is, and what changed?
0%- V1Obtainable source, matching build
Gemini's service, runtime and models are closed source and hosted by Google.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish the source of every required runtime component
- Make the deployed build verifiable against it
Fail - V2Owner-rooted identity
The agent's only identity is the owner's Google Account, which Google issues and can suspend.
› How it could pass
Suggestions. Any change that meets the test counts.
- Root agent identity in a key or domain the owner holds
- Let recipients verify agent actions without Google infrastructure
Fail - V3Change history and rollback
No change history or rollback is documented for instructions, Gems, memory, connected apps or model version. The activity log records chats, not changes to agent state.
› How it could pass
Suggestions. Any change that meets the test counts.
- Record who changed each part of agent state, and when
- Offer restore to an earlier state
Fail
Modifiable · Can you change anything, and can only you change it?
40%- M1Instructions and logic
Owners can add, edit and delete Instructions for Gemini and create and edit their own Gems. Google's base system prompt cannot be replaced, and the documentation does not say premade Gems can be edited.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner replace the base prompt and premade Gems
Partial - M2Memory
Instructions for Gemini are itemised, editable and deletable. Memory of past chats is not itemised: to remove something, the owner must delete the chats containing it, or correct Gemini in a chat. This memory feature is documented for Google AI plan subscribers.
- Get personalization with memory of your past Gemini chats
- Customize Gemini's responses with your instructions
› How it could pass
Suggestions. Any change that meets the test counts.
- Show every remembered item from past chats, with edit and delete controls
Partial - M3Tools
Owners who are 18+ in the US with a personal account can add custom MCP servers without Google review and remove them, and can disconnect Connected Apps. Gemini automatically uses public information from Google services such as Search, Maps and YouTube, and the documentation does not show a way to remove these or the other built-in tools.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner remove every built-in tool, including Search and the other first-party services
Partial - M4Owner has the final say
Some protections can be changed by the owner (for example, Keep Activity logging can be turned off). Others are locked: manual confirmation of write actions by custom apps is required, and no owner switch for it is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make every provider-imposed protection configurable, with a warning instead of a block
Partial - M5No unilateral change
Google changes the default model server-side (for example, 3.6 Flash 'introduced as default', 2026.07.21) and announces it only in release notes. The owner cannot decline the change or pin a version.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners pin the model and instruction versions
- Make behaviour-affecting changes opt-in, with notice beforehand
Fail
Controllable · Is your word final?
17%- C1Boundaries
Limits are on/off per connected app. No per-recipient, per-domain, per-path or per-tool allow or deny lists are documented, and no limit is documented to hold against model output or injected instructions.
› How it could pass
Suggestions. Any change that meets the test counts.
- Add per-recipient, per-domain and per-tool allow and deny lists
- Enforce the limits outside the model on every path
Fail - C2Approval gates
Google imposes manual confirmation for custom-app write actions, but the documentation shows no approval gate the owner can set or choose.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner choose which tools or action classes need approval
- Make gates hold on every path
Fail - C3Immediate halt
A reply can be stopped in the chat. Scheduled actions must be turned off one at a time in settings, and no single global stop is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide one control that stops in-flight, scheduled and background work
Partial - C4Data serves only the owner
Keep Activity is on by default for adults, and while it is on, chats are used to 'develop, and improve its services (including training generative AI models)' and a subset is reviewed by human reviewers. Both are opt-out, not opt-in.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make training and human review opt-in
- Require specific consent for any change to data terms
Fail - C5Credential custody
Connected Apps and custom MCP apps are listed and can be disconnected or removed one by one. The documentation does not say how quickly revocation takes effect or that Google keeps no copy afterwards, so the pass is withheld (G12).
› How it could pass
Suggestions. Any change that meets the test counts.
- Document where credentials are held and that they are deleted on revocation
Partial - C6Full deletion
Deleting Gemini activity or the Google Account does not remove human-reviewed chats, which are kept for up to three years. Backups can persist for up to 6 months, and some data can be retained for extended periods.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make one owner action delete every copy, including reviewed data and backups, within a stated limit, and confirm it
Fail
How this assessment was produced
One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Gemini (https://gemini.google.com).
During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.
- Model
- claude-opus-5-5
- Harness
- Claude Code 2.1.285
- Ran
- 2026-09-30 15:08:25 UTC · 29 turns
- Criteria hash
- a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
- Full transcript
- Download (JSONL, gzip) · every tool call, page read and reply
- Run protocol
- 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
- Human review
- pending
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/gemini.json.
Or grade it from scratch. See Check any score yourself.
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.