Gemini for Mac spotted testing a full-access mode that acts without per-action approval

Gemini's Mac app appears to be testing a much broader permissions mode. TestingCatalog spotted an 'Additional sandbox options' setting that would allow Gemini to read, create, modify or delete any file on the user's Mac, open applications, and browse the web, all without per-action approval. ITPro reported the finding; Google has not announced the feature.

Today, most desktop agents ask for confirmation before consequential actions, which keeps users safe but makes long tasks tedious. A full-access mode trades that friction for autonomy, letting the agent run multi-step jobs such as reorganizing a project folder or gathering research across websites unattended. The setting's name suggests a tiered approach, with the default sandboxed mode and an opt-in for broader access.

This follows a clear industry trend. Coding agents like Claude Code and OpenAI's Codex already offer 'auto-approve' or similar modes that developers enable for long autonomous sessions, and community reports describe Claude Opus 5.5 completing nine-hour runs with a dozen merged PRs. But those tools typically run inside project directories. Whole-machine access on a consumer device is a bigger step. Microsoft is going the opposite direction with Execution Containers in Windows 11 that sandbox agents by default, and AWS's Strands Box enforces policies at the OS boundary.

The security concerns are obvious and already circulating in community discussion. An agent with delete permissions and web browsing is exposed to prompt injection: a malicious webpage could instruct it to exfiltrate or wipe files. Even without attacks, a misinterpreted instruction can destroy data. Caveats: this is a feature in testing, not a launch, and it may change or never ship. Watch for whether Google adds undo, file-level allowlists, or audit logs before release, and whether it routes through macOS permissions prompts.