THE DAILY EDITION · 10 OCTOBER 2026
Google is pitching agents it cannot yet secure
Why this argument?
This column argues Google’s Search agents deserve attention because the company is selling background action while naming unresolved agent security work.
Opinion, written by AI from this week's verified reporting. Every factual claim is checked against the primary sources listed below; the argument is the column's own.
Google said it is introducing information agents in Search that can work in the background, 24/7, find what users need, and help them take action. It said the agents roll out this summer starting with Google AI Pro and Ultra subscribers. Google is pitching agents before the safety story is good enough. The paying users go first. Google gets Search woven into more tasks. What it leaves out is the dull bit that matters: how a user, or Google, knows the agent stayed inside the job.
Google’s own research blog said a late-2025 workshop report breaks down foundational privacy and security challenges that autonomous agents face today, needing coordinated defenses at the system, model, user and ecosystem levels. It said the report explores systems that evaluate whether an action is socially and contextually appropriate before executing it. That is not a solved layer. It is still a problem to be handled, not a finished answer. The note points to more defense, not less.
Google introduced information agents in Search. Its report also proposed new safety evaluation approaches for highly autonomous, multi-agent systems and called for standardized multi-agent benchmarks in dynamic Agent Gym environments. There is the gap. If the evaluators need new gyms, the product demo is running ahead of the referee. Google wants the agent frame now, while the measuring tools are still being drawn.
METR said a researcher, helped by an AI agent, found in about 10 minutes a vulnerability that could have let an agent change what human reviewers saw in an Inspect transcript viewer. METR said it had not observed agents exploiting it and described it as a proof-of-concept exploit. That caveat matters. This was not a disaster. It was worse for the sales pitch: a small, concrete reminder that oversight tools can be fooled at the interface where humans think they are watching.
Google said Gemini 2.0 Flash can call tools such as Google Search, code execution and third-party user-defined functions. Google also said the experimental model was available to developers via the Gemini API in Google AI Studio and Vertex AI. This is what is new enough to matter. The model is not just answering. It is reaching for tools. If tool use arrives faster than dependable monitoring, the assistant becomes another system to audit after it has acted. That is backwards.
Google said Gemini Spark is rolling out to trusted testers, with a beta for Google AI Ultra subscribers in the U.S. the next week. Google said Search information agents roll out this summer, and its report called for new safety evaluation approaches for highly autonomous, multi-agent systems. Trusted testers are not the issue. The issue is the direction of travel: subscription access, background Search agents, and safety writing that is still asking for new tests. Ship the monitors first. Then sell the agent.