Hidden Gemini Desktop setting would let Google's agent read, change and delete any Mac file
Google is testing a Gemini Desktop option that could let its agent alter any Mac file and act through Mail, Safari and Messages without asking first. Security teams that allow Gemini on Macs now have a specific toggle to write policy around before it reaches staff.
The Watch · Security desk
What happened
- TestingCatalog found references to the setting, labelled "Additional sandbox options," in the Gemini Desktop app and posted them on X.
- Access would extend past the folders a user has explicitly connected to Gemini, reaching files anywhere on the machine.
- Gemini would still ask before buying products, transferring money, creating online accounts, accepting legal terms or changing sensitive personal information.
- The setting appears to belong to Google's wider computer-use plans for Gemini, covering files, websites and native apps beyond the chat window.
Why it matters
- Who has to decide decision BleepingComputer expects a Claude-style opt-in granted by the individual user, so organisations that permit Gemini Desktop have to decide whether staff may enable these options before the toggle reaches them.
- What it limits constraint Apple is weighing limits on agent access to personal Mac files, so what Google's option can actually reach on macOS may be set by Apple as much as by Google.
- What it sets up precedent With Gemini moving toward the permission model BleepingComputer compares to Claude's, desktop agents with file and app reach become a product category that a security policy has to name explicitly.
Next story · Product · Oct 7
SynthID.com lets anyone test a file for watermarks from Google, OpenAI, Nvidia and KakaoConfirmed19 publishers
Everything public comes from hidden references in the Gemini Desktop app, as described by BleepingComputer [1]. The feature is not live and Google has not confirmed it [2]. An attacker has nothing to use today [2]. The interface copy is plain about what it is for: "By enabling additional sandbox options, you will be able to expand what Gemini can do and access on your Mac," the hidden text reads, according to BleepingComputer [6].
According to BleepingComputer, the confirmation prompts would cover money, accounts, legal terms and sensitive personal data [8]. Deleting a file is not on that list. Neither is sending through Mail or Messages, the actions the hidden pop-up says Gemini could take [5][13].
Those two gaps are where a bad instruction turns into an incident. A deletion destroys data on disk. A sent message reaches its recipients from the user's real account, under the user's name [13].
With Safari in reach and permission to act without asking, the agent would read text written by strangers [5][7]. BleepingComputer's report does not say how Gemini would treat instructions found inside that text, or inside the files and messages it opens [14].
Timing and model are both open. BleepingComputer says it is unclear when Google will roll out what the report calls Full Access, or which Gemini model would run it [10].
What to watch
- Google confirming the feature, a rollout date for Full Access, or the Gemini model that would power it.
- Whether Google ships controls that let organisations block or limit the sandbox options centrally, separate from the user's own opt-in.
- Apple's decision on restricting AI agent access to personal files and data on macOS.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
As spotted by TestingCatalog on X, Google is testing desktop control for Gemini, and there are references to a new hidden "Additional sandbox options" setting in the Gemini Desktop app.
- [2]
The feature isn't live yet, and Google hasn't confirmed it.
- [3]
When enabled, Gemini could read, create, modify, or delete files anywhere on the device.
- [4]
Gemini would have access to files outside folders the user has explicitly connected to Gemini.
- [5]
According to a pop-up within Gemini Desktop, Gemini could communicate with apps such as Mail, Safari, or Messages and perform actions through them.
- [6]
"By enabling additional sandbox options, you will be able to expand what Gemini can do and access on your Mac,"
- [7]
"Depending on which settings you enable, Gemini may be permitted to take actions without asking for your permission first."
- [8]
Gemini would still ask for confirmation before buying products or transferring money, creating an online account, accepting legal terms on the user's behalf, or modifying sensitive information about the user.
- [9]
It is unclear how the feature will play out, as Apple is considering making it difficult for AI agents to access personal files and data on Mac.
- [10]
It is unclear when Google plans to roll out Full Access or which Gemini model will power it.
- [11]
Users can expect a Claude-like experience, where the user explicitly gives Gemini permission to use the computer.
- [12]
The setting appears to be part of Google's broader computer-use plans for Gemini, where the AI would work across files, websites, and native apps instead of being limited to a chat window.
- [13]
The confirmation categories BleepingComputer lists (purchases, money transfers, account creation, legal terms, sensitive personal information) do not include deleting or modifying files, or sending and acting through Mail, Safari or Messages, all of which the setting would allow.
- [14]
None of the described material (capabilities, confirmation categories, interface text, permission model) addresses how Gemini would handle instructions embedded in files, web pages or messages it reads.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comGoogle Gemini could soon get full access to your Mac’s files, apps and the web
1 article · October 3, 2026
- itpro.comNew Google Gemini setting could give AI tool broad access to users' Macs
1 article · October 7, 2026
Topics and entities
Topics
- Computer-use AI agents
- macOS privacy permissions
- Endpoint Security And Fleet Integrity