AI Governance Institute
← News
Corporate Policy2026-10-04

Gemini Desktop's Broad Mac File Access Exposes Enterprise Data Boundaries

What happened

Google is internally testing an 'Additional sandbox options' feature for Gemini Desktop on macOS, discovered in hidden interface references by security researchers. The feature would allow Gemini to read, create, modify, or delete files anywhere on the device. This is not limited to folders a user has explicitly shared. It would also let Gemini communicate directly with applications including Mail and Safari. Unlike the current model, which requires user approval for each action, the new mode would operate autonomously across the file system. Only a narrow set of high-stakes actions, such as financial transactions or accepting legal terms, would still require explicit confirmation. The feature is not yet in production, but its discovery signals Google's direction for Gemini Desktop as an agentic tool with broad endpoint reach. This follows a pattern of expanding agent permissions across the industry, consistent with concerns raised after Apple restricted macOS disk access, forcing an AI agent permission audit.

Why it matters

  • ·Broad, standing file system access without per-action approval expands the blast radius if Gemini is manipulated by a malicious file or instruction. An attacker who can influence what the agent reads could cause it to copy, modify, or delete sensitive documents at scale without any human approval gate.
  • ·Employees may enable this mode themselves through a settings toggle, giving compliance teams no centralized signal. Organizations subject to sector-specific data handling rules, including those under the General Data Protection Regulation (GDPR) or financial services data governance requirements, face regulatory exposure if protected data on an endpoint falls within the agent's reach.
  • ·Enterprise data loss prevention tools are typically designed around human-initiated file transfers, not AI agent reads and writes. A tool operating with broad file system access and app-level communication will likely move sensitive data in ways existing controls are not configured to detect or block.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-007Agent Scope and Task BoundariesAGT-018Agent Data Modification Blast-Radius ContainmentAGT-008Agent Environment IsolationSEC-003Sensitive Data Handling in AI Pipelines

What to do now

  • ☐Audit which employee devices, corporate and personal, have Gemini Desktop installed or could install it without IT approval, and document whether your current endpoint policies cover AI tools with broad file system access.
  • ☐Review your existing data loss prevention configuration to determine whether it can detect an AI agent reading or copying sensitive files, and engage your security team on whether controls need to be updated before this feature reaches general availability.
  • ☐Define in writing which categories of data on corporate endpoints an AI desktop agent is not permitted to access, such as legal files, HR records, or credentials, and confirm whether your current Gemini Desktop deployment settings enforce those limits.
  • ☐Ask your Google Workspace account representative whether enterprise tenants will receive administrator controls to restrict or disable the broad-access mode before it reaches production, and document the response for your vendor governance file.
  • ☐Add Gemini Desktop's upcoming file system access mode to the agenda of your next AI governance committee review, and assign a named owner to track the feature's general availability date and any accompanying enterprise policy controls.

What to watch next

Compliance teams should monitor Google's official Gemini Desktop release notes for general availability of the expanded sandbox options feature. They should also watch for any enterprise administrator controls that would allow centralized restriction. Regulators and data protection authorities in jurisdictions with strict endpoint data handling rules, including those enforcing the EU AI Act (Regulation (EU) 2024/1689), may treat broad autonomous file access by a consumer-facing AI tool as a compliance event if employee devices hold regulated data. AI vendors are expanding agent permissions without parallel enterprise governance controls. This has already been flagged in guidance such as the Five Eyes Guidance on the Careful Adoption of Agentic AI Services. This will not be the last capability of this kind to reach enterprise endpoints.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Standards2026-10-24

ICO Sets Binding-Standard Expectations for AI Agents Under UK GDPR

The UK Information Commissioner's Office has published expectations on agentic AI. Organizations must treat AI agent autonomy as a deliberate design choice. It must be backed by proportionate guardrails, defined permissions, and human approval thresholds. The guidance applies existing UK GDPR security and accountability obligations to agentic AI deployments without waiting for new legislation. The ICO also flagged the risk that a security failure in one agent could spread personal data breaches across connected systems.

Corporate Policy2026-10-23

Walmart's Agent Gateway Sets Industry Benchmark for Agentic Commerce Controls

Walmart has opened its shopping platform to third-party AI agents through a new Agent Gateway built on the Model Context Protocol. This standard allows AI systems to connect with external services. The retailer has published explicit governance terms requiring agents to stay within shopper intent, prohibiting payment method changes, and limiting data access to only what each task requires. Enterprise controls include mandatory purchase approval by default, configurable spending limits, segregated purchase histories, and the ability to revoke agent access at any time.

Corporate Policy2026-10-23

NemoClaw Flaw Lets Any Webpage Hijack Local AI Agents Without Authentication

Oasis Security disclosed a vulnerability in NVIDIA's NemoClaw framework affecting organizations running local Ollama AI agent instances. An attacker-controlled webpage can send hidden instructions directly to the local agent runtime without any login or user click required. Organizations using self-hosted AI agents should treat this as an urgent signal to verify authentication, network segmentation, and prompt injection defenses on all local agent deployments.