Google CC
Google (Google Labs) · labs.google/cc
CC is a Google-hosted, closed-source Gemini agent. It reads a member's chosen Gmail, Calendar and Drive data, sends a daily briefing and takes limited actions such as drafts, calendar entries and form filling. Its data is governed by the general Google Privacy Policy and Terms. No export, model choice, action log, change history or owner-editable instructions or memory are documented, so almost all portability, transparency, audit, verification and modification tests fail. Some controls exist: each member chooses what CC can see, a disconnect/delete route is reported, and actions outside the group reportedly require permission.
- Per-member choice of which emails, Drive folders and calendars CC can see
- Reported rule that CC will not act or share outside the group without permission
- An owner-initiated disconnect/delete route, with Google's general deletion timeline (~2 months, backups up to 6 months)
- Disclaimer states CC data is not used to train Google's foundational generative AI models
- No export of agent state and no way to run CC without Google's servers
- Locked to Google-selected Gemini models with no pinning; behaviour can change server-side
- No owner-visible action record, change history, system prompt or editable memory
- CC-specific retention, staff review and secondary-use terms are not disclosed; the general Google Privacy Policy applies
All 26 findings
Hosted web/mobile service; runs on Google-operated isolated cloud instances (Antigravity harness, 'latest Gemini models'). No version number published. Desk review on 2026-09-30. The live labs.google.com/cc pages (landing, disclaimer, FAQ, terms, privacy) serve only a JS sign-in shell with no public text; the CC-specific disclaimer was read from a Wayback Machine copy dated 2026-03-30, which predates the group release.
Portable · Can you leave, take the whole agent with you, and keep it alive?
0%- P1Owner-usable round trip
No documented export of a CC agent exists, and CC runs only on Google-operated infrastructure, so it cannot be restored elsewhere.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer an export of the whole agent and a matching importer or runtime not operated by Google
Fail - P2Complete export
No export format or bundle is documented. Memory, instructions, schedules, CC's own account identity and history all stay with Google.
› How it could pass
Suggestions. Any change that meets the test counts.
- Export memory, instructions, schedules, history and identity in a complete bundle
- Allow integrations to be re-linked without a Google-registered client
Fail - P3Runs without the provider
CC runs on Google's cloud instances under a Google account and needs Google's servers to start or act. The Google Terms licence is personal and non-assignable, and Google may suspend or terminate access.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide a runtime that runs without any Google service or account
- Grant a perpetual, irrevocable right to run it
Fail - P4Model independence
CC is built on 'the latest Gemini models' and offers no documented way to choose another model or a local one.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner pick any model that meets a documented minimum, including a local open-weight model
Fail - P5Exit survives termination
Nothing binding keeps CC state available after a ban, suspension or the Labs experiment ending. Google Terms promise Takeout export on discontinuation, but nothing shows Takeout covers CC state, and there is no post-ban export window.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in terms to a post-termination export window of at least 30 days that also covers bans
- Publish a shutdown plan for the experiment that includes export
Fail
Transparent · Can you see everything the agent is, and everything shaping it?
13%- T1Readable without the provider
Agent state (memory, instructions, logic, history) is held in Google's hosted service. No documented format or schema allows reading it outside that service.
› How it could pass
Suggestions. Any change that meets the test counts.
- Store agent state in a documented format the owner can read outside Google's service
Fail - T2What runs is what you see
The base prompt and assembled context are not visible to the owner, and Google does not document the exact model in effect ('latest Gemini models'; a specific model name appears only in press reports). That is both shortfalls.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner view the full assembled context for any call
- Show the exact model version and all tools and settings in effect
Fail - T3No shadow data
No CC-specific retention schedule exists. The general Google retention policy allows keeping some data for the life of the account or longer for security, legal and other purposes, and does not itemise per service.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish a CC retention table with bounded periods
- Let the owner view everything the service retains
Fail - T4No hidden steering
CC openly works only through Google services (Gmail, Calendar, Drive, reportedly the Maps API), and these cannot be replaced. No paid placement is documented, but no binding no-steering commitment exists either.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make first-party service defaults replaceable or switchable
- Put a no-paid-placement commitment in binding terms
Partial
Auditable · Can you reconstruct exactly what the agent did, and trust the record?
0%- A1Complete action record
No owner-visible, durable record of CC's actions is documented. Drafts, events and emails show up in Google apps, but there is no action log.
› How it could pass
Suggestions. Any change that meets the test counts.
- Keep a durable log of every CC action with targets and arguments, covering every trigger path
Fail - A2Tamper-evident, owner-checkable
No action record or integrity data is documented, so tampering cannot be detected.
› How it could pass
Suggestions. Any change that meets the test counts.
- Add hash-chained or signed entries with an open verifier anchored with the owner
Fail - A3Agent cannot rewrite its record
No action record and no protection of one against the agent is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Write the record from a component the agent cannot reach, with read-only access for the agent
Fail
Verifiable · Can you prove what it runs, who it is, and what changed?
0%- V1Obtainable source, matching build
Required components (CC service, Antigravity-hosted runtime, Gemini) are closed. Google Terms forbid copying or modifying Google software.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish source for every required component with the right to modify it
- Make the running build verifiable against that source
Fail - V2Owner-rooted identity
CC's identity is its own Google account, issued and controllable by Google, which can suspend or terminate it.
› How it could pass
Suggestions. Any change that meets the test counts.
- Root the agent's identity in something the owner holds, such as an owner key or domain, that Google cannot revoke
Fail - V3Change history and rollback
No way is documented to see, attribute or roll back changes to CC's memory, instructions, model or settings.
› How it could pass
Suggestions. Any change that meets the test counts.
- Keep an attributed change log of agent state with one-step restore
Fail
Modifiable · Can you change anything, and can only you change it?
0%- M1Instructions and logic
Base instructions are set by Google. The owner can only 'teach' CC preferences by email, with no documented, viewable or editable instruction layer. Under G12 that doesn't count as an editable owner layer.
› How it could pass
Suggestions. Any change that meets the test counts.
- Expose the base prompt and default workflows as owner-editable instructions
- Provide a documented owner instruction layer whose edits persist
Fail - M2Memory
CC keeps personal and shared household memory, but no itemised view, edit or delete control is documented. Memory can only be changed by asking the agent, or cleared by deleting or disconnecting the account; deleting a source email does not remove it from memory (third party).
› How it could pass
Suggestions. Any change that meets the test counts.
- Show every memory item, personal and shared, with edit and delete controls
Fail - M3Tools
CC has a fixed set of Google-provided capabilities, with no documented way to add owner tools or remove built-ins.
› How it could pass
Suggestions. Any change that meets the test counts.
- Accept owner-built tools (for example MCP) without review
- Let the owner remove built-in tools
Fail - M4Owner has the final say
Google-imposed protections (for example, CC originally could only email the account owner) are fixed. No owner setting to change them is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Document every provider protection and let the owner change it, with a warning
Fail - M5No unilateral change
CC uses 'the latest Gemini models' on Google's service with no version pinning or opt-in updates. Google changes the model and behaviour server-side.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner pin model, runtime and instruction versions
- Announce behaviour changes in advance and make them opt-in
Fail
Controllable · Is your word final?
25%- C1Boundaries
Data scope is per source (members choose emails, folders, calendars), and CC responds only to group members. But contact outside the group is a permission prompt, not a per-recipient allow list. Public evidence also doesn't settle whether limits hold against model output or the agent changing its own settings, which counts as a second shortfall under G12. Spend is treated as met (G11): CC has no payment capability.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer per-recipient and per-domain contact lists
- Document that limits are enforced outside the model and the agent's write access
Fail - C2Approval gates
There is a fixed gate: CC reportedly needs permission before acting or sharing outside the group, and it prepares drafts rather than sending them. The owner cannot choose which action classes are gated.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner gate any tool or action class
- Document that the gate holds regardless of model output
Partial - C3Immediate halt
A disconnect route is reported (Google Account connections page), but no documented guarantee says it stops in-flight, scheduled (daily brief) or background work within seconds.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide one documented global stop covering scheduled and background work, resumed only by the owner
Unverified - C4Data serves only the owner
The disclaimer excludes training of foundational models. Otherwise CC data falls under the general Google Privacy Policy, which allows using data to improve and develop services and legal disclosure without a notice commitment. Staff or human review of CC data is not disclosed, and no CC-specific opt-out exists.
› How it could pass
Suggestions. Any change that meets the test counts.
- Disclose staff access and make any human review or secondary use opt-in in binding CC terms
- Notify the owner of legal disclosures where lawful
Fail - C5Credential custody
Members choose and can change what CC may access, and access can reportedly be revoked via Google Account connections. Primary sources don't establish a per-grant list with immediate effect, or that no copy is kept after revocation.
› How it could pass
Suggestions. Any change that meets the test counts.
- List every grant CC holds with per-grant revoke
- Commit to deleting provider-side copies on revocation
Partial - C6Full deletion
Third parties report an owner-initiated account delete or disconnect that removes CC data. Google's general policy gives about 2 months for deletion and up to 6 months for backups. No completion confirmation is documented, and nothing states whether deletion covers CC's own account and shared memory.
› How it could pass
Suggestions. Any change that meets the test counts.
- Confirm completion of deletion to the owner
- State that deletion reaches CC's account, shared memory and backups within a published limit
Partial
How this assessment was produced
One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Google CC (https://labs.google/cc).
During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.
- Model
- claude-opus-5-5
- Harness
- Claude Code 2.1.285
- Ran
- 2026-09-30 15:13:10 UTC · 32 turns
- Criteria hash
- a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
- Full transcript
- Download (JSONL, gzip) · every tool call, page read and reply
- Run protocol
- 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
- Human review
- pending
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/google-cc.json.
Or grade it from scratch. See Check any score yourself.
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.