Google is testing a setting in its Gemini desktop app for macOS that would let the assistant work with files anywhere on a Mac and operate other applications on the user's behalf, BleepingComputer reported Saturday. The feature has not been announced, and Google has not said when, or whether, it will ship.

What Happened

The option was spotted by TestingCatalog, which posted its findings on X. Hidden references in the Gemini Desktop app describe a setting called "Additional sandbox options." Interface text found in the app says that turning it on expands what Gemini can do and access on the Mac.

When enabled, Gemini would be able to read, create, modify and delete files anywhere on the computer, including in locations outside the folders a user has explicitly connected to the app. It could also open and operate apps such as Mail, Safari and Messages to carry out tasks, according to BleepingComputer.

RelatedEight States Sue OpenAI as Iowa Seeks Court Halt on Testing of Advanced AI Models

Google appears to be building in limits. Gemini would still have to ask for confirmation before sensitive actions, including buying products, transferring money, creating online accounts, accepting legal terms and changing personal information. BleepingComputer compared the approach to a Claude-like setup in which users explicitly give the assistant permission to use their computer.

Google has not confirmed the feature, its timing or which Gemini model would power it. The report was written by Mayank Parmar.

Why It Matters

The change would turn Gemini on the Mac from an assistant that works inside a defined set of folders into an agent that can act across the whole system. For users, that means multistep tasks, such as finding a document, attaching it to an email and sending it, could happen without manual hand-offs between apps.

It also widens what can go wrong. An agent that can read every file and drive Mail and Messages is a more valuable target for prompt injection, in which instructions hidden in a web page or document try to steer the model. The confirmation prompts Google is planning cover money, accounts, contracts and personal data, but the reported list does not mention routine file edits or deletions.

For companies, the open question is control. Many organizations manage Macs centrally, and an opt-in switch that grants an AI agent access to the entire disk is the kind of setting IT departments will want to lock down or audit.

Context

Rivals moved earlier into full desktop control. Anthropic introduced computer use for Claude in October 2024, letting the model operate a desktop by viewing the screen and controlling the mouse and keyboard, and OpenAI launched its Operator browsing agent in January 2025. A Mac app with system-wide reach would put Gemini in more direct competition with those tools.

What to Watch

The signs to look for are an official announcement, the Gemini model behind the feature and whether the expanded mode reaches business editions of Gemini with administrator controls. How Google explains the boundary between actions that require approval and those that do not will also matter for security teams weighing whether to allow it on managed Macs.