Quirin Schlegel

Loading

It signs in as you

Google's Gemini Spark now runs Chrome errands inside a user's own logged-in session, and Google's own security post says the model never touches the stored password — so the exposure is not the secret but the authenticated session, which arrives at your service indistinguishable from a human. Article 50(1), applying since 2 August 2026, informs the person in front of the agent and says nothing to the service behind it, so agent identity is an engineering control and not a compliance one. Note also that Google's exclusion list fell from ten markets to four between 17 June and 14 July and the EEA, Switzerland and the UK stayed on it, with no reason given.

4 August 20266 verified claims6 sources

Google's new browsing agent does not steal your password. It borrows something harder to see: your session.

On 30 July Google said Gemini Spark can use your logged-in Chrome accounts and saved passwords to run web errands — researching flights, scheduling apartment viewings. United States first.

Every headline landed on "it can use your saved passwords." So I read Google's own write-up on agentic browsing security. It says close to the opposite of the scary version: "the model does not have direct access to stored passwords" when it signs in through Password Manager. The secret never reaches the context window.

Good. That is the smaller problem, solved.

The bigger one starts after the login succeeds. The agent then holds an authenticated session belonging to a person. Google's own support page notes that browser data, "like cookies that contain your website authentication info," is saved for future sessions.

Now flip to the other end of the connection — the end most of us build.

You run a service in the EU. A request arrives on a valid session. Your logs will say a human did it. Nothing in the AI Act corrects that. Article 50(1) has applied since Sunday, and it requires providers to ensure "the natural persons concerned are informed that they are interacting with an AI system." The duty points at the human in front of the agent. It points nowhere at the service behind it.

What I'd do Monday:

1. Give agents their own identity — own scopes, own credential, never a human's cookie. If you cannot name the actor, you cannot log it.

2. Treat any human-credential session as unattributable. Not forbidden. Unattributable. Write that word in your evidence.

3. Read PSD2 Article 97 next to your agent roadmap. Strong customer authentication needs two independent elements. A stored password is one — and it is the one an agent can replay.

4. Ask vendors, in writing, whether their agent presents itself or presents your user.

And the detail I keep rereading. In June, Google's own changelog blocked Spark in ten markets. By 14 July: four. Australia, Canada, Hong Kong, India, Japan and South Korea came off the list. The EEA, Switzerland, the UK and Nigeria did not. Google gives no reason for that.

What is your agent logging in as right now?

#AgenticAI #EUAIAct #AgentIdentity #AICompliance #Berlin

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

On 30 July 2026 Google announced that Gemini Spark can "use your logged-in accounts and saved passwords to handle tedious web errands" inside Chrome, initially rolling out in the United States, and states that it keeps the user "in the loop on sensitive actions, such as payments, by handing the task back to you".
Why it mattersThe delegation boundary is drawn at payments, not at authentication. Everything short of a payment happens inside a session that already belongs to a person, which is exactly the traffic a service operator sees and cannot distinguish.
google2026gemini
Google's own Gemini Spark changelog narrowed the product's market exclusions between June and July 2026: the 17 June 2026 entry excludes Australia, Canada, the European Economic Area, Hong Kong, India, Japan, Nigeria, South Korea, Switzerland and the United Kingdom, while the 14 July 2026 entry excludes only the European Economic Area, Nigeria, Switzerland and the United Kingdom. Google states no reason for the remaining exclusions.
Why it mattersSix markets came off the list in four weeks and the EEA did not. For a team in the EU this is the practical availability picture for consumer credential-delegating agents, and it is stated by the vendor rather than inferred from trade coverage.
googlegemin2026whats
Google's Gemini Spark support documentation states that when Gemini uses the remote browser, "browser data, like cookies that contain your website authentication info (your sign-in details), is saved for future sessions", and sets eligibility at 18 or over, in the United States, with a Google AI Ultra subscription and Keep Activity enabled.
Why it mattersPersistence is the part that matters to whoever operates the site being visited. An authenticated cookie held across sessions is a standing human identity in the hands of software, and it is invisible in an access log.
googlegemin2026gemini · googlegemin2026whats
Google's agentic browsing security post of 8 December 2025 states that when signing into sites via Google Password Manager "the model does not have direct access to stored passwords", that indirect prompt injection is "the primary new threat facing all agentic browsers", and that the agent will "try to pause and either get permission from the user" before purchases, payments or other consequential actions.
Why it mattersIt corrects the popular reading of the July feature. The credential itself is not exposed to the model; the risk that remains is the authenticated session and the hostile page, which are architecture problems rather than secret-handling problems.
google2025architect
Article 50(1) of the AI Act, applying from 2 August 2026, requires providers to ensure that AI systems intended to interact directly with natural persons are designed so that "the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious". The duty is owed by the provider to the natural person interacting with the system; the Regulation places no corresponding duty to disclose agent status to a third-party service that the agent operates on the user's behalf.
Why it mattersA service operator receiving agent traffic gets no signal from this Article. The only place the distinction can be made is the operator's own authentication layer, which makes agent identity an engineering decision rather than a compliance one.
euaiactexpl2026article
Under Directive (EU) 2015/2366 (PSD2), strong customer authentication is authentication based on "two or more independent elements categorised as knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is)", and Article 97(1) requires payment service providers to apply it where the payer accesses a payment account online, initiates an electronic payment transaction, or carries out any other remote action implying a risk of unauthorised or fraudulent access.
Why it mattersA stored password is a single knowledge element. An agent replaying it satisfies one factor and cannot supply the second on its own, which is why the payment boundary is a hard line in the EU rather than a product preference.
eurlex2015directive

Sources

EU AI Act Explorersecondary
Article 50- Transparency Obligations for Providers and Deployers of Ce
Original Archived PDFretrieved 15 October 2026 · published 1 January 2026
EUR-Lexprimary source
EUR-Lex - Directive 2015-2366 PSD2
Original Archived PDFretrieved 4 August 2026 · published 25 November 2015
Googleprimary source
Google - Architecting security for agentic browsing
Original Archived PDFretrieved 4 August 2026 · published 8 December 2025
Googleprimary source
Google - Gemini Spark Chrome browsing
Original Archived PDFretrieved 4 August 2026 · published 30 July 2026
Google Gemini Apps Helpprimary source
Google Gemini Apps Help - Gemini Spark requirements
Original Archived PDFretrieved 4 August 2026
Google Gemini Apps Helpprimary source
Google Gemini Apps Help - Whats new for Gemini Spark
Original Archived PDFretrieved 4 August 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

No corrections. One date was rejected during drafting: secondary coverage placed the Chrome announcement on 3 August 2026; the date used is 30 July 2026, from Google's own post. One framing was rejected: the widely repeated "Spark can use your saved passwords" is narrowed here by Google's own statement that the model does not have direct access to stored passwords.