Gemini Spark
Google · gemini.google/overview/agent/spark
Gemini Spark is a Google-hosted, always-on agent inside the Gemini Apps that runs tasks, schedules and skills across Google Workspace, custom MCP apps and a local or remote browser. It gives owners visible task progress, editable and downloadable skills, custom MCP connections and a turn-off switch. It runs only on Google's models and infrastructure, requires Keep Activity (which enables training and human review), and has no complete export, provider-independent runtime or owner-set approval and scope controls.
- Skills are editable plain-text SKILL.md files and downloadable as .zip
- Any MCP server can be added as a custom app without Google review
- Connected Apps and custom MCP links can be revoked one by one
- Owner instructions and skills are editable and can be switched off
- No complete export and no runtime outside Google's cloud or models
- Spark requires Keep Activity, which enables model training and human review
- No owner-set approval gates or per-recipient, instruction-source or spend limits
- Closed source, a Google Account as identity, and no tamper-evident record or rollback
All 26 findings
Hosted service as documented on 2026-09-30 (help centre 'What's new' latest entry July 2026; Privacy Hub last updated 2026-09-24; Google Terms effective 2026-07-30). Platform: web app, with notes on the Mac app and Chrome auto browse. Region: US-style availability (not EEA/UK/CH/NG). Desk review only; no account was used.
Portable · Can you leave, take the whole agent with you, and keep it alive?
10%- P1Owner-usable round trip
Spark is a Google-hosted feature of the Gemini Apps; the only documented exports are per-skill .zip downloads and Google Takeout of account data. No documented route restores a working agent (tasks, schedules, skills, connections) on any runtime Google does not operate.
- Use Gemini Spark to manage your tasks & workflows
- Create & manage skills for Gemini Apps
- Gemini Apps Privacy Hub
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide a one-action export of the whole agent
- Ship an importable runtime or format that restores it on owner-chosen infrastructure
Fail - P2Complete export
Skills can be downloaded individually as .zip and account data can be exported through Takeout, but no documentation shows schedules and triggers, remote-computer files, remote-browser state, past-chat memory or integration links leaving Google in usable form; Connected Apps and MCP links rely on Google Account linking.
- Create & manage skills for Gemini Apps
- Find & manage your Gemini Spark tasks
- Gemini Apps Privacy Hub
- Connect custom apps (MCP) in Gemini
› How it could pass
Suggestions. Any change that meets the test counts.
- Export schedules, triggers, memory, remote-computer state and the action record in one bundle
- Allow integrations to be re-linked without a Google-registered client
Fail - P3Runs without the provider
Spark runs in Google's cloud ('Spark runs in the cloud instead of on your phone or computer') and requires a signed-in personal Google Account plus a Google AI Pro or Ultra subscription; cancelling the subscription removes access to Spark, tasks and schedules.
- Use Gemini Spark to manage your tasks & workflows
- Create & manage schedules for tasks in Gemini Spark
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer a provider-independent runtime with a perpetual right to run
Fail - P4Model independence
Spark runs only on Google's Gemini models; the documented model options (Gemini 3 Flash-Lite, Flash, Pro) are all Google-hosted, and no documentation shows third-party or local model support.
› How it could pass
Suggestions. Any change that meets the test counts.
- Support owner-chosen models, including local open-weight models, with every capability intact
Fail - P5Exit survives termination
After subscription cancellation Spark data is retained but paused, and the Terms promise 'reasonable advance notice' and a Takeout opportunity when a service is discontinued, except in urgent situations. Download from a disabled account is 'may be able to', and accounts 'may be disabled without the ability to download data for certain violations'; no 30-day guarantee exists.
- Google Terms of Service (effective July 30, 2026)
- Your account is disabled - Google Account Help
- Create & manage schedules for tasks in Gemini Spark
› How it could pass
Suggestions. Any change that meets the test counts.
- Bind a guaranteed export window of at least 30 days after any termination, including for-cause bans
Partial
Transparent · Can you see everything the agent is, and everything shaping it?
13%- T1Readable without the provider
Agent state (tasks, schedules, remote-computer files, memory, provider instructions) is readable only through Google's Gemini apps and services. Skill files are plain-text SKILL.md, but the main state has no documented open format outside Google's service.
- Use Gemini Spark to manage your tasks & workflows
- Create & manage skills for Gemini Apps
- Gemini Apps Privacy Hub
› How it could pass
Suggestions. Any change that meets the test counts.
- Document an open format for all agent state readable without Google services
Fail - T2What runs is what you see
Google does not publish the base system prompt or provider-injected context that Spark runs with (shortfall 1), and the Spark pages do not document which Gemini model or version a task uses, while the limits page notes 'model names, versions, and availability may change' (shortfall 2). Owners see planned steps, progress, skills, apps and files used.
- Use Gemini Spark to manage your tasks & workflows
- Gemini Spark overview
- Gemini Apps limits & upgrades for Google AI subscribers
› How it could pass
Suggestions. Any change that meets the test counts.
- Show the full model context, including provider instructions, for any task step
- Display the model and version in effect for each task
Fail - T3No shadow data
Google says it retains some data 'longer when necessary for legitimate business or legal purposes' with no stated bound, and some data 'until you delete your Google Account'. Human-reviewed chats are kept for up to 3 years, disconnected from the account and not visible item by item.
› How it could pass
Suggestions. Any change that meets the test counts.
- Disclose and bound every retention period
- Make all held data, including reviewed copies, visible item by item
Fail - T4No hidden steering
Google says Gemini chats 'are not being used to show you ads. If this changes, we will clearly communicate it to you', which is a non-binding statement. Spark uses Google Search services (Flights, Hotels, Maps) and shows 'Trending' tasks and 'Recommended' skills; no documented paid or self-preferencing ranking was found, but the absence is not bound by terms.
- Gemini Apps Privacy Hub
- Use Gemini Spark to manage your tasks & workflows
- Use & manage Connected Apps in Gemini
› How it could pass
Suggestions. Any change that meets the test counts.
- Make a binding commitment against paid or self-preferencing influence, or disclose it with an off switch
Partial
Auditable · Can you reconstruct exactly what the agent did, and trust the record?
17%- A1Complete action record
The work panel shows steps and the files Gemini read or updated, and activity lives in Gemini Apps Activity. But Gemini Apps Activity auto-deletes after 18 months by default (pruned by default). Public docs also do not show that entries include arguments and recipients or that failed recording is surfaced (counted as not met under G12).
- Use Gemini Spark to manage your tasks & workflows
- Gemini Apps Privacy Hub
- Manage & delete your Gemini Apps activity
› How it could pass
Suggestions. Any change that meets the test counts.
- Keep the action record until the owner deletes it
- Record every action with its targets and arguments, and alert the owner when recording fails
Fail - A2Tamper-evident, owner-checkable
No documentation describes integrity data, hash chaining or an independent verifier for Spark's task history or Gemini Apps Activity. Google holds the record and it can be changed without trace from the owner's side.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide an open verifier with owner-held or independent anchoring for the action record
Fail - A3Agent cannot rewrite its record
No documented Spark tool edits Gemini Apps Activity or task threads, and skills cannot be deleted from a chat or task thread. But in the local Chrome browser Spark 'has access to all the same sites that you do, including sites you're signed into', and that path is limited only by model-applied 'site and action restrictions' (policy-level protection).
› How it could pass
Suggestions. Any change that meets the test counts.
- Enforce technically that the agent cannot reach the action record through any path, including the signed-in browser
Partial
Verifiable · Can you prove what it runs, who it is, and what changed?
0%- V1Obtainable source, matching build
Spark's runtime, the Gemini apps and the Gemini models are closed and Google-hosted. No source is published for any required component.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish the source of every required runtime component under a modifiable licence, with verifiable builds
Fail - V2Owner-rooted identity
The agent has no identity of its own. It acts as the owner's Google Account, with 'Sign in with Google', Google Account-linked Connected Apps and Password Manager logins, and Google can disable that account.
- Use Gemini Spark to manage your tasks & workflows
- Connect custom apps (MCP) in Gemini
- Your account is disabled - Google Account Help
› How it could pass
Suggestions. Any change that meets the test counts.
- Root the agent's identity in an owner-held key that Google cannot revoke or impersonate
Fail - V3Change history and rollback
Skills and schedules can be edited and saved, but no documented version history, diff, attribution or rollback exists for skills, schedules, instructions, memory, tools or model changes.
- Create & manage skills for Gemini Apps
- Create & manage schedules for tasks in Gemini Spark
- Customize Gemini's responses with your instructions
› How it could pass
Suggestions. Any change that meets the test counts.
- Record every state change with its author
- Offer restore to any prior state
Fail
Modifiable · Can you change anything, and can only you change it?
30%- M1Instructions and logic
Owners can create, edit, replace and deactivate skills, edit schedule instructions and set 'Instructions for Gemini'. Google's base instructions and built-in behaviour cannot be replaced, and Google notes that owner instructions to avoid topics 'doesn't always work perfectly'.
- Create & manage skills for Gemini Apps
- Customize Gemini's responses with your instructions
- Create & manage schedules for tasks in Gemini Spark
› How it could pass
Suggestions. Any change that meets the test counts.
- Allow the base prompt and every provider default to be replaced, with changes persisting
Partial - M2Memory
Instructions for Gemini are itemised and editable. Past-chat memory can be managed only by deleting the source chats or correcting Gemini in conversation, and what Gemini has inferred is not itemised ('just ask Gemini'). Remote-computer files and remote-browser data can only be deleted as a whole.
- Get personalization with memory of your past Gemini chats
- Customize Gemini's responses with your instructions
- Use Gemini Spark to manage your tasks & workflows
- Gemini Apps Privacy Hub
› How it could pass
Suggestions. Any change that meets the test counts.
- Itemise every persistent memory store, including inferred past-chat memory and remote-computer files, with edit and delete
Partial - M3Tools
Owners can add any MCP server as a custom app in the web app without Google review, and can disconnect Connected Apps. Some built-ins cannot be removed: Gemini 'can always use public information from Google Search', and no documented setting removes the remote browser or remote computer from Spark.
- Connect custom apps (MCP) in Gemini
- Use & manage Connected Apps in Gemini
- Use Gemini Spark to manage your tasks & workflows
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner remove every built-in tool, including search, the remote browser and code execution
Partial - M4Owner has the final say
Provider protections such as 'prohibited task recognition', site and action restrictions, mandatory take-control for passwords and payments, required confirmation for custom-app write actions, and the no-network rule for skill scripts are set by Google. No documented control lets the owner change them.
- Use Gemini Spark to manage your tasks & workflows
- Connect custom apps (MCP) in Gemini
- Create & manage skills for Gemini Apps
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner change or disable each provider-imposed protection (the runtime may warn)
Fail - M5No unilateral change
Google changes Spark server-side through dated rollouts (new connected apps, monitoring behaviour, notifications). Model names and versions 'may change', Gems are being removed and auto-converted to skills, and no pinning or decline option is documented.
- What's new for Gemini Spark
- Gemini Apps limits & upgrades for Google AI subscribers
- Create & manage skills for Gemini Apps
› How it could pass
Suggestions. Any change that meets the test counts.
- Give notice before behaviour-affecting changes and let the owner decline or pin the current version
Fail
Controllable · Is your word final?
8%- C1Boundaries
Limits are mostly on/off: per-app connections, per-device autobrowse and per-folder Mac access. No documented control limits whom the agent takes instructions from (content such as emails and websites can inject instructions), whom it contacts, or how much it spends; its web purchases can use saved Password Manager logins. Site scope is chosen by the model.
- Use Gemini Spark to manage your tasks & workflows
- Use Gemini Spark with the Gemini app on Mac
- Create & manage schedules for tasks in Gemini Spark
- Connect custom apps (MCP) in Gemini
› How it could pass
Suggestions. Any change that meets the test counts.
- Add owner-set limits on instruction sources, recipients and spend
- Enforce every limit on all paths, independently of model output
Fail - C2Approval gates
Confirmation prompts cover a fixed set of classes that Google defines, and Gemini is 'designed to ask' for them. Owners cannot choose which classes need approval, and Google Tasks bulk actions proceed without confirmation. Google also warns that offline schedules may complete unintended actions.
- Use Gemini Spark to manage your tasks & workflows
- Connect custom apps (MCP) in Gemini
- Create & manage schedules for tasks in Gemini Spark
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner choose which action classes need approval, enforced on every path including schedules
Fail - C3Immediate halt
Per-task Stop and 'Turn off Gemini Spark' exist, and turning Spark off pauses all schedules and tasks until the owner turns it back on. No documented guarantee covers how fast in-flight provider-side work stops. Stopping a local-browser run may lead Gemini to continue via the remote browser, and after subscription cancellation 'in-progress Spark tasks will finish'. Per the C3 note this is Unverified.
- Use Gemini Spark to manage your tasks & workflows
- Create & manage schedules for tasks in Gemini Spark
- Gemini Apps Privacy Hub
› How it could pass
Suggestions. Any change that meets the test counts.
- Document a single control that halts all in-flight, scheduled and remote work within seconds
Unverified - C4Data serves only the owner
Spark requires Keep Activity to be on, and with it on 'Google uses your activity to provide, develop, and improve its services (including training generative AI models)' with human reviewers. So content use for training and staff review is on by default and cannot be turned off while using Spark. Data-term changes follow Terms updates on notice, not specific consent.
- Use Gemini Spark to manage your tasks & workflows
- Gemini Apps Privacy Hub
- Google Terms of Service (effective July 30, 2026)
› How it could pass
Suggestions. Any change that meets the test counts.
- Make training and human review opt-in and available while using Spark
- Require specific consent for data-term changes
Fail - C5Credential custody
Connected Apps and custom MCP servers are listed and can be disconnected or unlinked one by one. Remote-browser cookies holding website sign-ins are neither itemised nor revocable per site ('delete all saved browser data'), and Google says this data is used 'consistently with the Gemini Apps Privacy Notice', which does not limit use to owner-directed actions.
- Connect custom apps (MCP) in Gemini
- Use & manage Connected Apps in Gemini
- Use Gemini Spark to manage your tasks & workflows
- Gemini Apps Privacy Hub
› How it could pass
Suggestions. Any change that meets the test counts.
- Itemise every stored credential and session with per-item revocation
- Bind use of owner credentials to owner-directed actions only
Partial - C6Full deletion
Deleting the agent takes several steps: task threads, schedules, skills, remote browser and remote computer data are deleted separately, and turning Spark off deletes remote data only. Human-reviewed chats 'are not deleted when you delete your activity' and are kept for up to 3 years. Google-wide deletion 'generally takes around 2 months', and backups can last up to 6 months.
- Find & manage your Gemini Spark tasks
- Use Gemini Spark to manage your tasks & workflows
- Gemini Apps Privacy Hub
- How Google retains data we collect
- Delete your Google Account
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide one action that deletes every Spark element and all provider copies, including reviewed chats, within a stated limit, with confirmation
Fail
How this assessment was produced
One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Gemini Spark (https://gemini.google/overview/agent/spark/).
During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.
- Model
- claude-opus-5-5
- Harness
- Claude Code 2.1.285
- Ran
- 2026-09-30 15:07:44 UTC · 27 turns
- Criteria hash
- a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
- Full transcript
- Download (JSONL, gzip) · every tool call, page read and reply
- Run protocol
- 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
- Human review
- pending
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/gemini-spark.json.
Or grade it from scratch. See Check any score yourself.
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.