Gemini
Google · gemini.google.com
Gemini provides export of chats and Gems via Google Takeout, editable instructions and Gems, confirmation prompts for sensitive agent actions and, for paid US users, custom MCP connections. It is a hosted, proprietary service tied to Google accounts and models, with system instructions not published, memory derived from chats not directly editable, default-on activity-based training and human-reviewed chats retained up to three years.
- Takeout export of Gems and Gemini Apps activity in open formats
- Instructions for Gemini and Gems readable and editable
- Confirmation before sending, purchases and form submission in agent tasks
- Custom MCP apps supported in Gemini Spark
- No ads currently in the Gemini app
- No runnable export; runtime and models are provider-only
- System instructions not published
- Derived memory not viewable or editable item by item
- Training on chats when Keep Activity is on; reviewed chats kept up to 3 years
- Custom tools gated to paid plans, US and Keep Activity on
- No tamper-evident audit trail
All 34 findings
Consumer Gemini app (web, Android, iOS) with personal Google Accounts, including Gems, memory/personal context and Gemini Agent/Spark (Google AI Pro/Ultra), per public documentation as of 2026-09-27. Workspace and Gemini Enterprise not assessed.
Portable · Can you leave, and take the whole agent with you?
8%- P1Round-trip portability
Incomplete, delayed and not restorable: Google Takeout exports Gems and activity asynchronously without memory, Connected Apps or credentials, and there is no import to restore them; Gemini's chat import accepts only ChatGPT and Claude exports.
Fail - P2Complete export
Takeout exports chats, generated media, uploads and Gems, but documentation does not state that memory derived from past chats, personal-context settings, Connected Apps configuration or credentials are included, so part of the agent stays with Google.
Partial - P3Independent execution
The Gemini app runtime and models are Google-hosted proprietary services; no open-source runtime can run the exported agent without Google servers.
Fail - P4Identity continuity
The agent's identity is the Google Account, which does not travel with an export, so nobody the agent has dealt with can verify its continuity after a move.
Fail - P5No kill switch
The functioning agent exists only on Google infrastructure and depends on the Google Account; exported files carry no license check but are not an executable agent.
Fail - P6Capability independence
Memory, Connected Apps, Gems and agent tasks are delivered by Google's platform and run only on Gemini models; none is documented to work with another provider or a local model.
Fail
Transparent · Can you see everything the agent is, with ordinary tools?
33%- T1Open storage format
Takeout exports activity in readable formats (such as JSON or HTML in a .zip/.tgz archive), but live internal storage is undocumented and accessible only through Google's software.
Partial - T2No hidden instructions
Owner instructions and Gem instructions are visible, but Google does not publish the Gemini app's system instructions or the personal context it injects from past chats and connected apps.
Fail - T3No shadow memory
Chats are retained 72 hours even with Keep Activity off, and chats selected for human review are retained up to three years even after the owner deletes activity.
Fail - T4Complete action history
Agent tasks show progress and a work panel of files accessed or modified, and chats are kept in Gemini Apps Activity and exportable via Takeout when Keep Activity is on. No complete record of actions and tool calls is documented, and history depends on activity settings.
Partial - T5Readable logic
Gems and instructions are plain natural-language text, but the app's agent logic and task orchestration are closed source.
Partial - T6No third-party influence channel
Google states there are no ads in the Gemini app and that Gemini chats are not used to show ads. Google has not made a binding commitment to keep the app ad-free and has described itself as open to ads, which already run in AI Overviews and AI Mode in Search.
Partial
Auditable · Can you reconstruct exactly what the agent did?
10%- A1No unrecorded actions
Google does not document whether every consequential agent action is durably recorded, or whether an action is blocked when it cannot be recorded.
Unverified - A2Tamper evidence
Owner-visible history in Gemini Apps Activity can be deleted or auto-deleted without a detectable trace, and no tamper-evident record is documented.
Fail - A3Separation from the audited
Google does not document whether the agent layer can alter or delete records of its own actions.
Unverified - A4Readable with ordinary tools
Takeout exports of Gemini Apps activity are readable with ordinary tools, but they are an activity export rather than a dedicated audit trail.
Partial - A5Corroborated interactions
The consumer app documents no agent-to-agent exchanges whose records each side could match against the other's.
Unverified
Verifiable · Can you prove the agent runs what it claims?
0%- V1Open, reproducible runtime
The Gemini app and its service runtime are proprietary; no OSI-licensed, reproducible runtime is published.
Fail - V2Active config is inspectable config
The system instructions and injected personal context the app runs with are not published, so active configuration cannot be compared with inspectable configuration.
Fail - V3Attributable messages
Messages go out through the owner's Google and connected accounts, so recipients cannot verify that they came from this agent, and no attribution survives leaving Google.
Fail - V4Independently checkable record
No action record is offered whose integrity can be checked with open tools that do not depend on Google.
Fail - V5Comparable state
Server-side state is not fully exposed and Takeout is partial, so the owner cannot verify whether the agent's state changed between two points in time.
Fail
Modifiable · Can you change anything, without asking?
33%- M1Instructions
Owners can view, edit and delete Instructions for Gemini and Gem instructions, but cannot read or rewrite the app's system instructions.
Partial - M2Memory
Saved instructions are editable and past-chat memory can be switched off, but there is no viewer for individual derived memories; Google advises deleting the underlying chats or correcting Gemini in chat.
Partial - M3Logic
Owners can create and edit Gems and Spark tasks/schedules, but cannot change the underlying agent logic or add executable code.
Partial - M4Tools and permissions
Owners can enable or disable Connected Apps, and can add custom MCP servers for Gemini Spark. Custom apps require 18+, the US, a personal account, Keep Activity on and Spark access (Google AI Pro/Ultra).
Partial - M5Model choice
Only Google's Gemini models can be selected in the app; third-party or local open-weight models are not supported.
Fail - M6No gatekeeping
Adding custom tools requires a paid Google AI Pro/Ultra plan and eligible region, and depends on enabling Keep Activity.
Fail
Controllable · Is your word final?
42%- C1Communication boundaries
Owners choose which Connected Apps are enabled, and agent tasks ask before sending communications, but owners cannot set which recipients or channels the agent may contact, and no enforcement below the model is documented.
Partial - C2Approval gates
Agent tasks prompt for confirmation before sending communications, modifying data, purchases and form submissions. The gated categories are set by Google, not selected by the owner, and enforcement cannot be independently verified.
Partial - C3Immediate halt
Owners can stop a task with Stop response or Take control of the browser, and can pause scheduled tasks from the work panel.
Pass - C4Data sovereignty
All content is processed on Google servers by design. With Keep Activity on, Google uses chats to train its models and a subset is human-reviewed; this is opt-out rather than opt-in.
Fail - C5Credential custody
Connected Apps and custom MCP credentials are held by Google; owners can disconnect apps, but tokens are not inspectable and do not travel with an export.
Fail - C6Full deletion
Owners can delete Gemini Apps activity and Gems or their Google Account, but chats reviewed by humans are retained for up to three years, disconnected from the account.
Partial
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.