Gemini for Mac Tests a Hidden “Full Access” Setting

Google’s Gemini app for Mac contains a hidden setting that would give the AI far wider reach over the computer. It is unreleased: testers found it, Google has not announced or confirmed it, and there is no date [1][2][3].

Spotted via @RoundtableSpace on X. The original find was posted by TestingCatalog (@testingcatalog) on X.

What was found

On 2 October the feature-tracking account TestingCatalog posted a screenshot (credited to @bedros_p) of a dialog for a “still hidden” setting called “Additional sandbox options” [1]. BleepingComputer says Google “is testing desktop control” for Gemini and that the feature “isn’t live yet, and Google hasn’t confirmed it either” [2]. Google did not answer IT Pro’s request for comment [3].

The dialog says: “By enabling additional sandbox options, you will be able to expand what Gemini can do and access on your Mac. Depending on which settings you enable, Gemini may be permitted to take actions without asking for your permission first” [1]. It lists:

• “Reading, creating, modifying, or deleting files anywhere on your Mac”, including files outside connected folders “and files belonging to other people stored on your device”;
• “Sending and receiving data over the network without your approval for each connection”, including services “you are logged into”;
• “Communicating with other applications on your Mac (such as Mail, Safari, or Messages) and performing actions through them” [1].

The same dialog says Gemini “is designed to ask for your confirmation” before buying products or transferring funds, creating an online account, accepting legal terms or modifying sensitive information about the user [1]. TestingCatalog’s suggestion that Gemini 4 will power it is its own guess [1].

Sandbox versus full access, in plain terms

A sandbox is a fence around software: an assistant inside one can only touch what it has been handed. That is how Google describes the shipped product. Gemini Spark for macOS, in beta since 30 June for Google AI Ultra subscribers in the US, “only has access to the files you give it permission to use” [4]. Its help page says Gemini “can only view files or directories that you specifically add” to its Connected folders, which users can disconnect [5].

Full access removes most of that fence: an agent that can read any file, connect to the network without asking and drive Mail or Messages is no longer limited to what the user hands it, and can reach other people’s data on the same Mac.

Why it matters for privacy and security

Two risks grow with access. Mistakes: Google’s help page warns that users “may not be able to recover files” once Gemini deletes them [5]. And manipulation: an agent that reads web pages and messages can be fed hostile instructions, and the more it may do without asking, the more such an attack could achieve.

The timing is awkward. On 2 October Apple told developers: “Some developers are using Full Disk Access in ways that could put users at risk.” It will add controls so that granting “this extraordinary level of access” needs “very explicit user action”, warning: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially” [6]. Apple named no app and gave no date. Whether Google’s setting would use Full Disk Access is unknown.

Confirmed versus being tested

• Confirmed by Google: Gemini Spark for Mac is in beta, works with connected folders and is designed to ask before deleting or sharing files [4][5].
• Being tested (reported, unconfirmed): a hidden “Additional sandbox options” setting with the wider access described above [1][2][3].
• Unknown: whether, when or in what form it ships, and how it would interact with Apple’s coming controls [2][3][6].

What this does not prove

• That the feature will ship. Google has not confirmed it [2][3].
• That it is on by default. The dialog describes an opt-in choice [1].
• That Gemini can do any of this today. The shipped beta is limited to connected folders [4][5].

The Bottom Line

Google appears to be testing a mode that would let Gemini act across a whole Mac, not just in folders a user picks. Until Google documents it, the cautious course, especially on work Macs, is to leave undocumented full-access options alone and follow your organisation’s IT policy.

Sources

1. TestingCatalog (@testingcatalog), X post with screenshot (credited to @bedros_p), 2 October 2026, 16:20 BST (read via the X API; screenshot viewed). https://x.com/testingcatalog/status/2106041553806336167
2. Mayank Parmar, “Google Gemini could soon get full access to your Mac’s files, apps and the web”, BleepingComputer, 3 October 2026. https://www.bleepingcomputer.com/news/google/google-gemini-could-soon-get-full-access-to-your-macs-files-apps-and-the-web/
3. Emma Woollacott, “New Google Gemini setting could give AI tool broad access to users’ Macs”, IT Pro, 8 October 2026. https://www.itpro.com/software/apple/new-google-gemini-setting-could-give-ai-tool-broad-access-to-users-macs
4. Google, “Gemini Spark updates: macOS launch, connected apps and more”, 30 June 2026. https://blog.google/innovation-and-ai/products/gemini-app/gemini-spark-updates-june-2026/
5. Google, “Use Gemini Spark with the Gemini app on Mac”, Gemini Apps Help. https://support.google.com/gemini/answer/17208717?hl=en
6. Apple, “Updates to Full Disk Access in macOS”, Apple Developer News, 2 October 2026. https://developer.apple.com/news/?id=p6zjojqw
7. RoundtableSpace (@RoundtableSpace), X post, 8 October 2026, 21:15 BST (credited as where TSN spotted the story; its wording that Gemini “is quietly getting” the setting goes further than the evidence). https://x.com/RoundtableSpace/status/2108290081551466898