Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Gemini in Chrome Keep a Record of What It Did?
Not completely. Gemini in Chrome leaves a work log in the tab it works in and Google keeps Gemini Apps activity on its own retention terms, but the pages reviewed describe no exported, per-page record of what the agent read, so ask for that export in writing.
An auditor asks what a browser agent read on a payroll page, and the first answer is a tab. Gemini in Chrome keeps a running account of the steps it takes, Google's enterprise posts describe that account and the confirmation it asks for before a purchase or a send, and the Gemini Apps notice gives chat activity a deletion term. None of those is a list of the pages the agent opened, the fields it read and the values the model received. That difference decides whether the trail is evidence or a reminder of what someone watched. A team that cannot produce the page, the time and the value the model saw cannot answer a regulator, a customer or its own data protection officer, and it cannot tell a read of one employee's record from a passing mention of a name. The exposure is largest where the screen carries salary, bank or health data, which is where an agent is most useful. Gemini in Chrome is also narrow today: experimental, off by default for managed users, and limited for now to personal accounts in the United States. Google's own documentation describes what the agent leaves behind; an auditor's request asks for more.
Key findings
- For the record to answer an auditor, the values on a payroll page would have to be replaced with consistent tokens before the model reads them, so the trail holds EMP_001 where the salary sat (What Is an AI Control Record?).
- It would also require a named person approving each read of a full employee record and an exported account of what the model received on every screen (What Is Supervised Delegation?).
- Google Cloud's Future Mode post says the agent "logs its exact logic in a work log in the browser tab," and the post describes no export of that log for a security team (Google Cloud, Future Mode, 2026).
- Google's Chrome Help page states that Gemini "has access to the same sites that you do, including sites you're signed into," an access statement that says nothing about what the page records (Google, Chrome Help, 2026).
- The Attacker Moves Second reports that adaptive attacks bypassed 12 published defenses with "attack success rate above 90% for most," which is why the record of what an agent read matters after a defense fails (Nasr et al., 2025).
- AWS's Well-Architected guidance states that "audit logs attribute every action unambiguously to either an agent or a human actor," a property a work log in a browser tab does not establish (AWS, 2026).
What does Gemini in Chrome log while it works?
Google's Chrome Help page describes auto browse as a way to "ask Gemini in Chrome to complete multi-step tasks for you on the web," and it calls the capability experimental: "Gemini in Chrome working as an agent is an experimental feature" (Google, Chrome Help, 2026). The Chrome Help page limits eligibility: users must "Be 18 or over and in the US" and hold a Google AI Pro or Ultra plan on a personal account, so the trail exists for a narrow set of accounts (Google, Chrome Help, 2026).
The Future Mode post is where Google comes closest to a record: the agent "logs its exact logic in a work log in the browser tab," and the post describes no export of that log for a security team (Google Cloud, Future Mode, 2026). The log is a narrative of steps, useful to whoever watches the tab and gone when it closes.
Google Cloud's April post says auto browse "is designed to pause and explicitly ask for your confirmation or for you to complete some tasks like making a purchase or hitting send on an email," a prompt at the keyboard that the post does not describe as recorded (Google Cloud, New ways, 2026). The Chrome Help page places the outcome with the user: "You're responsible for Gemini's actions during a task, including mistakes and unexpected results like purchases" (Google, Chrome Help, 2026). Responsibility settles who answers for a mistake, not what an investigator can read.
Where does the record live, and how long does it last?
The Gemini Apps privacy notice is the page that gives chat activity a retention term. It says "Your activity is auto-deleted after 18 months," and temporary chats are kept for 72 hours, terms that belong to a consumer product rather than to a Workspace agreement (Google, Privacy Hub, 2026). The same notice says "Reviewed chats are retained for up to three years," a window that outlasts the activity record beside it (Google, Privacy Hub, 2026). Neither term is written for an agent working through a payroll console.
For managed browsers, Google's Chrome Enterprise administrator help states that "Auto browse is currently off by default for managed users" and that Gemini in Chrome "can use the context of the currently viewed webpage" with user permission, policies about where the agent may go rather than about what it read (Google, Chrome Enterprise, 2026). An administrator who enables the feature gets reach and a switch, and the page describes no switch that writes a record.
A work log inside the tab belongs to the browser session, and it cannot be queried by page after the tab closes. A complete log of what a model read is itself a repository of sensitive records, as (How Do You Audit What an AI Agent Saw and Did?) sets out, so its custody has to be decided before the log exists.
What do the vendors themselves say?
Google's Workspace guidance lists one layer as "Identifying and redacting external image URLs and suspicious links," a defense applied to what reaches the model rather than to the record of what it read (Google Workspace Admin Help, 2026). That layer changes the content of a page before the model sees it; it does not produce an entry an auditor can read.
The Future Mode post also describes "requiring explicit human approval before any high-stakes action is committed," a requirement stated without a named approver or an exported record (Google Cloud, Future Mode, 2026).
| Dimension | Google, per its documentation | What a buyer should verify |
|---|---|---|
| Retention | Gemini Apps activity is auto-deleted after 18 months, and temporary chats are kept for 72 hours (Google, Privacy Hub, 2026) | Whether the term covers what the agent did, and what a Workspace contract adds |
| Confirmation | A pause for the person before a purchase or a send (Google Cloud, New ways, 2026) | Whether a name, a time and an amount are written down |
| Reach | The same sites the user is signed into, including accounts with live sessions (Google, Chrome Help, 2026) | Which accounts one run can touch |
The rows describe a record that stays close to the run. None combines a page, a time and the value the model received in one entry, so the documentation describes the session rather than what the agent read.
What is missing from the trail for an auditor?
An agent opens a payroll console, searches for one employee and reads the record that comes back: name, salary, bank account, tax withholding. The auditor's question is which of those fields reached the model. A per-page list of that kind is not described in the pages reviewed. The work log in the tab describes steps in the agent's own words, and a chat record keeps what was said; neither keeps the field values as the model received them.
The research record explains why the question matters after the fact. Shi et al. describe "a suite of adaptive attack techniques to run continuously against past, current, and future versions of Gemini," a testing program that assumes attacks reach the model's context (Shi et al., 2025). A review of browsing agents records findings that "include prompt injection, domain validation bypass, and credential exfiltration" once untrusted web content reaches that prompt (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?).
The activity record is deleted after 18 months, before many reviews begin. A control at the browser governs where data may go; a control at the render layer governs what the page shows the model (Enterprise Browser or Render-Layer Tokenization?), which is what makes a per-page record possible.
What should a buyer ask for in writing?
The first question is what the model receives from a rendered screen: the page as a person sees it, or a version where sensitive values are replaced before the model reads it. An answer that says the model receives the page settles the record question in the negative, because a record can only hold what the model was given.
Three asks belong in a contract. The first is a page-level entry for every screen the agent read, with the address, the time and the fields the model received. The second is the values as the model received them, so a review can tell a salary, which the audit does not use, from SAL_001. The third is a named person and a time for every approval.
| Ask | Why it matters to an auditor |
|---|---|
| A page-level entry | A tab log shows that a step ran, not which employee record it opened |
| Values as received | A salary, which the audit does not use, and SAL_001 are different records of the same event |
| A named approver | A prompt with no name answers a different question from an approval with one |
| An export the organization keeps | A record that stays in the browser cannot be compared across runs or kept for the audit cycle |
An administrator comparing managed browsers can put the same asks to the Chrome Enterprise Premium controls in (RedactSure vs Chrome Enterprise Premium: 2026 Comparison & Alternative). A vendor that answers with a policy setting rather than a record has answered a different question.
An administrator export is not the norm in the review: 5 of the 15 agents describe a record of each action that an administrator can export, and Gemini in Chrome is not one of the five (Do AI Agents Ask Before Making a Payment?).
What does a governed environment change?
A governed environment acts where the page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a payroll screen draws EMP_001 and ACCT_001 where the name and the account number sit, and the salary the audit does not use renders as SAL_001. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at the approved destination, at the moment a named person approves the action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For the record question, three things change. The stored trail holds tokens, so a log kept for an audit cycle is not a second copy of the payroll record. The export names the page, the time, the values the model received and the person who approved the read, which is the entry Google's pages do not describe. And the record leaves the browser, so retention follows the organization's schedule rather than the tab's lifetime, which is the difference between a record an auditor can use and a transcript that ends with the session.
The scope is the rendered page of the task. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP.
The comparison for this product line sets the two designs side by side: RedactSure vs Gemini in Chrome: 2026 Comparison & Alternative.
What the record shows
Control over what an agent reads on a screen is what makes its trail checkable. Google documents a work log in the browser tab and no per-page export of the fields the model read (Google Cloud, Future Mode, 2026). For a payroll page that means an auditor can learn that the agent worked and what it said, and cannot learn which employee's record it opened. Run one task against a payroll test record, then ask for the page address, the time, the values as the model received them and the person who approved the read; a record that cannot produce those four for one page will not produce them in an investigation.
Methodology and limitations
This page rests on Google's Chrome Help article for auto browse, its Chrome Enterprise administrator help, two Chrome enterprise blog posts, the Gemini Apps privacy notice and Google Workspace's guidance on layered defenses, together with AWS Well-Architected guidance and two research preprints. Public documentation read in full gives a sound view of where each product applies its control. Vendor and research pages were read between October 22, 2026 and October 23, 2026, and each Sources line carries the date for its page.
The products are described from their public documentation, and none was tested for this page. Where the page says a record does not exist, it means the pages reviewed. The example describes a record type, not an organization. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Gemini in Chrome keep a record of what it did?
Not completely. Google Cloud's enterprise post says the agent "logs its exact logic in a work log in the browser tab," and Gemini Apps activity has a deletion term. Neither is a per-page record of the fields the model read. A work log describes the steps in the agent's words, and the activity record covers the account rather than the page. What survives a closed tab is whatever a person copied out of it, which is not evidence a security team can query.
Where is that record kept, and how long does it last?
In the browser tab and in the Google account, on different terms. The work log lives in the tab and ends with the session. Gemini Apps activity is "auto-deleted after 18 months," and temporary chats are kept for 72 hours; reviewed chats last up to three years. None of those terms is written for an agent reading a payroll console, so an organization that needs the trail for a longer cycle has to keep its own copy.
Can an administrator export the record of an agent's browsing?
No export is described. The Chrome Enterprise administrator help documents a policy that turns auto browse on or off and policies that allow or block destinations by URL, and it describes no export of a work log. The Future Mode post describes the log staying in the tab. An administrator can therefore say whether the feature runs and where it may go, and cannot produce a file of the pages an agent opened. That is the gap a security review has to close.
Does the confirmation prompt count as an approval?
Only for the person at the keyboard. Google Cloud says auto browse "is designed to pause and explicitly ask for your confirmation" before a purchase or a send, and the post does not describe that confirmation being recorded or exported. A prompt with no name, no amount and no time answers a weaker question than an approval with all three. It also arrives after the agent has read the page.
What did the agent read on a payroll page?
Not from the record Google describes. A work log says the agent opened a payroll console and what it did next; a chat record says what was discussed. Neither lists the employee, the fields rendered and the values the model received. An auditor has to reconstruct that from the page and the session, or from a record written where the page was read. The absence is the finding.
What would a complete record contain?
Four fields for every screen: the page address, the time, the values as the model received them and the person who approved the action. Consistent tokens in place of the sensitive values let the record be kept without becoming a copy of the payroll file. The record should export to the organization's monitoring and stay for the audit cycle rather than the tab's lifetime. Anything less starts an investigation from memory.
How RedactSure Keeps What the Agent Read Inside the Record
An auditor's question about a payroll page ends in a browser tab that closes with the task, and the work log inside was never an export. Google Cloud's Future Mode post says the agent "logs its exact logic in a work log in the browser tab," a narrative, not a record of fields read.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opens a payroll record and the transcript keeps the salary, the account number and the employee's name. Inside, the page draws EMP_001 and ACCT_001, the salary the audit does not use renders as SAL_001, a named person approves the read, and the export lists the page, tokens and approver.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An auditor's question about a payroll record should not end in a tab that closes. Bring one task that reads a payroll page and see, with test values, what the model receives, who approves and what the export holds. Book a demo