Chrome Auto Browse: how Gemini acts for you

On 30 January 2026, Google’s Gemini update highlighted Personal Intelligence and Chrome auto browse. Personal Intelligence combines context from Gmail, Photos, YouTube and Search after opt-in. Auto browse is a Gemini 3 agentic feature that handles multi-step web tasks, including flight comparisons, forms, document collection and subscription management.

Google introduced auto browse for US AI Pro and Ultra subscribers. It could use Connected Apps and, with permission, Google Password Manager for authenticated work. Google said the agent pauses for confirmation on actions such as purchases or social-media posts. That control matters, but cannot eliminate errors in earlier steps such as selecting the wrong product or exposing form data.

The browser is a privileged runtime

A browser agent sees tab content, cookies, authenticated sessions and forms. Connected to Gmail and Calendar, it can combine private information with an untrusted page. That page may contain prompt injection aimed at the model, invisible to the user or styled as a system instruction.

The crucial boundary is that page content is data, not authority. The agent needs instruction hierarchy, source isolation, secret-flow controls and must not act merely because the DOM asks. Confirmation should show what will be sent, to whom and at what price — not a generic “continue?”.

Personalisation changes privacy

Personal Intelligence is opt-in and users can select or disconnect applications. Enterprises still need to decide whether work mail, history and browsing may become one context. Data minimisation means granting one message or event where possible, not an entire account.

Enterprise controls should include:

• an allowed Connected Apps policy,
• separate personal and work profiles,
• no password-manager use outside allowlisted domains,
• action logs without full secrets,
• DLP for paste and upload,
• central emergency disablement.

Testing a browser agent

Build authorised pages with conflicting instructions, hidden text, hostile documents and lookalike domains. Test cross-tab leakage, budget overruns, confirmation bypass and advertisements interpreted as instructions. Interrupt and resume tasks too; retained state must not bypass a previous denial.

Auto browse marks the move from AI that answers to AI acting inside authenticated sessions. Our browser-agent security guide provides a detailed threat model. Run a controlled red team before enabling it enterprise-wide.

Per-task permission model

The agent should not automatically see every tab and Connected App. Travel booking may need one date email, Flights and Calendar, but not Photos history. Show sources before starting and allow one-time grants. “Always allow” creates persistent access that users may forget.

For Password Manager, pause before fill, validate the exact domain and obtain confirmation. The agent should never read a password as text or carry it between domains. Passkeys reduce secret theft, while the agent can still take an unwanted action inside a valid session.

Transaction signing, not generic consent

A purchase confirmation should show merchant, item, quantity, full price, address and payment method. Publication should show account, audience and final text. Changing any parameter after approval requires new consent.

A page may push a more expensive option, hidden subscription or document upload “for verification”. Policy should restrict fillable field classes and deny uploads outside approved domains.

Agent incident response

Preserve navigation history, DOM snapshots, tool calls and confirmations while redacting passwords and payment data. Users need a stop control; administrators need feature shutdown and session revocation. After a bad action, determine whether the page, model, policy or consent caused it.

Does opt-in solve privacy? It is necessary but insufficient. Consent must be informed, granular and reversible, with data scope proportional to the task.

Enterprise deployment gate

Pilot in a separate profile without Password Manager and with read-only Connected Apps. Validate logs, DLP, consent granularity, stop controls and central shutdown. Then add one task class and a fixed domain allowlist. Avoid a general “do anything in the browser” permission because it has no measurable risk boundary.

---

Primary sources: Google — January 2026 Gemini Drop, Google Chrome — Gemini 3 and auto browse.