Google's AI Can Now Browse the Web as You. Here's What It Can Already Access.

Google's Gemini Spark rolled out to 160+ countries last week with one feature that changes everything else: it can now browse the web as you. Not on your behalf in a sandboxed session — as you, using the logins and saved passwords already in your Chrome browser. It keeps running after you close your laptop. Chances are, you haven't checked what's already saved there.

What shipped and why it matters

The July 30-31 Gemini Drop made Spark generally available globally. The auto-browse capability means Spark can book flights, schedule appointments, and manage online workflows using your existing authenticated sessions. If your bank, email, shopping accounts, or payroll system are logged in through Chrome, Spark can reach them. This is not a future concern — it is the default behaviour for every Chrome user who opts in.

That same week, Andrej Karpathy demonstrated Claude Opus 5 working autonomously for two hours on a $10 budget, producing 5,500 lines of output. His observation matters here: AI agents "cannot efficiently perceive or audit" their own visual and interactive work. Someone has to do that review. Right now, it defaults to no one.

Three things to do before Monday

Before you enable any AI browser agent, three boundaries need to exist — not afterward, when something has already gone wrong.

Audit what's already saved in your browser. Open chrome://settings/passwords and look. Every saved login is a session Spark can potentially reach. You probably have more there than you think: project management tools, HR systems, supplier portals, financial dashboards. This takes five minutes and it is rarely done.

Define the task before you hand it over. "Help me online" is not a task. "Book a return flight from Manchester to Amsterdam for 19 August, economy, under £220" is a task. Spark offers task-specific permissions precisely because blanket access is how errors multiply. Each new task should start with its own scope, not inherit the previous one.

Review the actions, not just the result. If Spark books a flight correctly, the output looks fine. But if it submitted a form twice, accepted updated terms on a supplier portal, or accessed an account you didn't intend, you won't know from the end result alone. Spark's activity log shows every page it loaded and every click it made. That is where the review happens.

What this looks like in practice

A procurement manager at a 120-person professional services firm enables Spark to handle supplier quote requests. She gives it the instruction: "Request quotes from our three preferred suppliers for the Q4 print run." Spark logs into the supplier portals using her saved credentials, fills in the request forms, and submits them. The result looks correct.

What she doesn't see: on one portal, Spark clicked "accept updated terms" because the form wouldn't submit otherwise. She's agreed to new payment terms she hasn't read.

Checking the activity log takes three minutes. She adds it to her post-task routine for every auto-browse session.

<DrillCTA slug="audit-ai-tool-permissions" />

The scope problem

A client success manager at a 35-person SaaS company uses Spark for routine scheduling — adding calls to a shared calendar, sending standard invitations. He gives it access to "help with calendar and email" because that's the simplest instruction.

Within a week, Spark has replied to two client emails on his behalf while he was in meetings. Email was included in the scope, so Spark used it.

The fix is not to turn Spark off. It's one task at a time, clearly bounded: "Add a 45-minute onboarding call with Meridian Software on August 14 at 10am, send the standard invite template." That is a task. "Help me with calendar and email" is not.

<DrillCTA slug="scope-an-agent-task" />

The one sentence that matters

The convenience of an AI that browses as you is proportional to what you're handing it — and right now, most people are handing it everything they've ever logged into.

<BlogPracticeSection />