2026-08-04 — It signs in as you

Google's Gemini Spark now runs Chrome errands inside a user's own logged-in session, and Google's own security post says the model never touches the stored password — so the exposure is not the secret but the authenticated session, which arrives at your service indistinguishable from a human. Article 50(1), applying since 2 August 2026, informs the person in front of the agent and says nothing to the service behind it, so agent identity is an engineering control and not a compliance one. Note also that Google's exclusion list fell from ten markets to four between 17 June and 14 July and the EEA, Switzerland and the UK stayed on it, with no reason given.

Post

Google's new browsing agent does not steal your password. It borrows something harder to see: your session.

On 30 July Google said Gemini Spark can use your logged-in Chrome accounts and saved passwords to run web errands — researching flights, scheduling apartment viewings. United States first.

Every headline landed on "it can use your saved passwords." So I read Google's own write-up on agentic browsing security. It says close to the opposite of the scary version: "the model does not have direct access to stored passwords" when it signs in through Password Manager. The secret never reaches the context window.

Good. That is the smaller problem, solved.

The bigger one starts after the login succeeds. The agent then holds an authenticated session belonging to a person. Google's own support page notes that browser data, "like cookies that contain your website authentication info," is saved for future sessions.

Now flip to the other end of the connection — the end most of us build.

You run a service in the EU. A request arrives on a valid session. Your logs will say a human did it. Nothing in the AI Act corrects that. Article 50(1) has applied since Sunday, and it requires providers to ensure "the natural persons concerned are informed that they are interacting with an AI system." The duty points at the human in front of the agent. It points nowhere at the service behind it.

What I'd do Monday:

  1. Give agents their own identity — own scopes, own credential, never a human's cookie. If you cannot name the actor, you cannot log it.

  2. Treat any human-credential session as unattributable. Not forbidden. Unattributable. Write that word in your evidence.

  3. Read PSD2 Article 97 next to your agent roadmap. Strong customer authentication needs two independent elements. A stored password is one — and it is the one an agent can replay.

  4. Ask vendors, in writing, whether their agent presents itself or presents your user.

And the detail I keep rereading. In June, Google's own changelog blocked Spark in ten markets. By 14 July: four. Australia, Canada, Hong Kong, India, Japan and South Korea came off the list. The EEA, Switzerland, the UK and Nigeria did not. Google gives no reason for that.

What is your agent logging in as right now?

#AgenticAI #EUAIAct #AgentIdentity #AICompliance #Berlin

First comment

Sources, primary first —

Google's announcement, 30 July 2026 — the "logged-in accounts and saved passwords" wording, US-first rollout, payments handed back https://blog.google/innovation-and-ai/products/gemini-app/gemini-spark-updates-july-2026/

Google's agentic browsing security post — "the model does not have direct access to stored passwords", and the confirmation step before banking or payment actions https://blog.google/security/architecting-security-for-agentic/

Google's Gemini Spark changelog — the 17 June entry (ten excluded markets) and the 14 July entry (EEA, Nigeria, Switzerland, UK) https://support.google.com/gemini/answer/17171264

Google's Spark support page — cookies containing sign-in details saved for future sessions https://support.google.com/gemini/answer/17094507

AI Act Article 50 — transparency duty toward the natural person, applying since 2 August 2026 https://artificialintelligenceact.eu/article/50/

PSD2, Directive (EU) 2015/2366 — Article 97 on when strong customer authentication applies, Article 4 on the two independent elements https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015L2366

One point cut for length: Google's security post is dated 8 December 2025 and describes agentic browsing generally. Whether it maps exactly onto the July 2026 Chrome path in Spark is not something Google states, so I have taken it as the company's standing architecture claim rather than a specification of this feature.

Claims

Sources

Corrections

No corrections. One date was rejected during drafting: secondary coverage placed the Chrome announcement on 3 August 2026; the date used is 30 July 2026, from Google's own post. One framing was rejected: the widely repeated "Spark can use your saved passwords" is narrowed here by Google's own statement that the model does not have direct access to stored passwords.