The onboarding screen for Google's Gemini Spark includes language that ought to give anyone pause. According to code discovered in the Google app and reported by Forbes, the text warns users that the AI agent "may do things like share your info or make purchases without asking."
This is not a bug report from a security researcher.
It is the disclaimer Google itself wrote for its marquee product of I/O 2026, the 24/7 AI agent designed to replace a dozen of your dedicated apps with a single, always-running intelligence. The company is betting that users will hand over their calendars, cameras, email, and shopping to one AI.
What stands in the way is not capability. It is trust, and Google has spent more than a decade squandering it.
The Agent That Does Not Wait for You
Gemini Spark, announced at Google's annual I/O developer conference in May 2026, is the company's most aggressive push yet to turn its AI into something more than a chatbot. Unlike the Gemini that answers questions or drafts emails on demand, Spark runs on cloud-based virtual machines using the Gemini 3.5 model, according to Google.
It can schedule meetings, search your Gmail, summarize conversations, create files, and organize content automatically, even when your phone is off or your laptop is closed. CEO Sundar Pichai told the I/O audience that Spark runs on virtual machines in the cloud, meaning, as TechCrunch reported from the keynote, "yes, you can close your laptop."
The service is rolling out to Google AI Ultra subscribers in the United States at a starting price of $99.99 per month. It launches with native connections to Canva, OpenTable, and Instacart, and Google says it plans to add integrations with more third-party apps in the coming weeks. The vision is explicit: instead of opening Maps to find a restaurant, Gmail to check a confirmation, and Calendar to block the time, you tell Spark what you want and it orchestrates everything. Google wants Gemini to become the layer between you and the apps, not another app in the drawer.
A Decade of Watching Google's Assistants Fade
This is not Google's first attempt to become the user's primary interface. The company launched Google Now alongside Android 4.1 Jelly Bean, surfacing contextual information from Gmail, Calendar, and location without any input.
As How-To Geek documented, Google Now showed boarding passes from flight confirmations, tracked packages from order receipts, and displayed commute times before you asked. It was praised as genuinely useful.
It was also slowly dismantled over the next several years, replaced first by Google Assistant, then by a "Today" view in the Google app, then by "Assistant Snapshot," and finally by Google Discover, a content feed that drives ad revenue rather than completing tasks.
Google Assistant, which succeeded Now, reached a large monthly active user base but never became the primary interface for most users' daily tasks. People continued opening Maps to handle, Gmail to read mail, and Photos to find pictures. The assistant was a shortcut, not a replacement. Even the earlier versions of Gemini, which arrived under the name Bard and later absorbed the Assistant's role on Android phones, have not changed that behavior. The Gemini app now has more than 900 million monthly users across 230 countries and 70 languages, according to Google's own figures shared at I/O 2026. But those users are still opening separate apps for separate tasks. A massive user base has not translated into a single point of control.
Why a Single AI Carries Risks That Separate Apps Do Not
The trust calculus for a dedicated app is straightforward. When you open Google Maps to navigate to a restaurant, the scope of what Maps can do is narrowly defined.
It knows your location. It knows your destination.
It does not know your email, your calendar, your credit cards, or your photo library. The failure surface is small.
Spark inverts this entirely. According to APK analysis by 9to5Google, behind the scenes Spark will use "your info from sources like Connected Apps, skills, chats, tasks, websites you're logged into, Personal Intelligence, location, and more." Every one of those data streams is a vector for error. The risks are not theoretical. More recently, the onboarding text for Spark explicitly states the AI may act without permission.
Google Vice President and General Manager of Ads and Commerce, Vidhya Srinivasan, addressed this directly at I/O 2026 by introducing the Agent Payment Protocol (AP2), a system designed to securely authorize purchases based on pre-approved user instructions. Yet the company still includes what Forbes called a "catch-all disclaimer" that the agent can make unexpected purchases.
What Google's Own Fine Print Reveals
Forbes reporter Paul Monckton examined the Spark onboarding text present in the Google app code under the string robin_agent_onboarding_card2_body_spark. The full disclaimer reads: "While it is designed to ask for your permission before taking sensitive actions, it may do things like share your info or make purchases without asking.
Make sure to supervise Gemini Spark, and don't rely on it for medical advice, legal, financial, or other professional help." The contradiction sits in plain language. The design goal is to ask permission. The disclaimer admits it might not.
The Verge's Jay Peters, who received early access to Spark, tested the agent on real tasks. He asked Spark to draft an email to a team at Google compiling wins from the previous week. The result was impressive enough that Peters wrote:
"When I got the result from Spark shortly after, I really said: 'Wow, that's actually nuts.'"
Spark found his wife's email address, pulled budget data from a Google Sheets spreadsheet, and composed a draft. But Peters also noted that Spark is currently unable to share access with his wife, and that while Google promises Gemini "doesn't train directly" on your Gmail inbox with Personal Intelligence turned on. Users still have to put their faith in the company's stewardship.
The $100 Question Nobody Has Answered
Google's counter-argument is that Spark is opt-in, expensive, and designed with safeguards. The $99.99 per month AI Ultra plan creates a high barrier; only power users and developers are likely to subscribe.
Google says Spark is designed to seek approval before taking significant actions, and the new AP2 payment protocol adds cryptographic authorization for transactions. The company also promises that Personal Intelligence mode does not train on user data.
These are real mitigations. But the history of assistant adoption suggests that technical safeguards do not solve the trust gap. Users who are comfortable asking Spark to summarize their inbox may be deeply uncomfortable letting it compare prices, open their wallet, and complete a purchase while they sleep.
The unpredictability of large language models compounds this. A hallucination inside a chat window is an annoyance. A hallucination inside a calendar, a payment system, or a photo library is a different category of problem.
For Google to succeed where Google Now and Google Assistant did not, it must prove that Gemini Spark is more reliable than any individual app it aims to replace.
That is an extraordinarily high bar.
No AI assistant from any major company has cleared it yet. The technology itself may be ready. The question is whether a decade of false starts and cautionary headlines has left users willing to find out.
Google wants Gemini to replace your apps. The apps have a much longer track record of not buying things without asking.
