The agent has your password
Google's Spark agent drives your real Chrome, with your sessions and your saved credentials, and hands back control at payment. The handback tells you what the designers were worried about — and what they were not.
Gemini Spark operates desktop Chrome using logged-in accounts and stored passwords, returning control to the user for payments.
Why the real browser
Because the alternative does not work. Sites break automation deliberately, sessions expire, logins are gated behind device checks. An agent inside the browser you already use inherits every authenticated session for free — which is the whole reason this is more capable than every headless attempt before it.
And why that is the problem
It inherits the credentials too. Every saved password, every live session, every service that trusts that browser profile. An agent driving it holds the union of your access, scoped by nothing but its own judgement about what to do next.
An API key has permissions. A browser profile has everything you ever logged into.
Prompt injection remains structurally unsolved, and this design puts it in the worst configuration available: the agent reads untrusted web pages while holding your cookies.
Read the boundary they chose
Control returns at payment. Not at authority, not at data access, not at anything irreversible that is not financial — at the point where a mistake shows up on a statement. That is a defensible line, and it is narrower than the risk.
The enterprise side is arriving at the opposite answer: agents deployed through consulting engagements with someone accountable for the integration, and the gateway, identity and audit layers built before scale rather than after.
Consumer agents get the credentials and a payment prompt. Enterprise agents get an identity and an audit trail. Only one of those is a security model.
AI Agent Store — AI Agents News — Week of August 14, 2026 → · AI Business — IBM, OpenAI Partner to Accelerate Enterprise AI → · Agentic.ai — Agentic AI News — August 2026 →