Gemini Spark moved from a web-and-mobile agent into the Mac desktop on June 30, 2026. The beta can work across user-approved folders, connected apps, schedules, skills, a browser, and custom Model Context Protocol services. Google also supports starting or supervising some Mac tasks from another signed-in device.
At launch, the macOS beta was limited to Google AI Ultra subscribers aged 18 or older, beginning in the United States. Spark availability has been evolving across regions and surfaces, so a launch-day eligibility statement should not replace the current support page.
The important product idea is broader than Mac automation. Spark is a long-running agent that can carry a task across local and cloud context: find invoices in a folder, prepare a spreadsheet, update it on a schedule, and share a proposed result through an app. That reach is useful, but every connected source expands the consequences of a bad instruction.
What Spark can do on a Mac
Users explicitly add files or folders to the Connected folders toolbar. Within those locations, Spark can analyze, edit, rename, reorganize, and in some cases delete files. It can combine local material with Google Workspace and other Connected Apps.
Google gives examples such as:
- sorting PDFs from Downloads into folders;
- editing a document and saving a copy locally;
- building a budget sheet from recent invoices;
- finding a local file and emailing it to a contact;
- scheduling a recurring update;
- starting a Mac task from a phone.
Spark creates temporary backup files when it changes computer files. The support page says those backups can be recovered before the next task and are deleted when a new query starts or after 24 hours. That is a convenience, not a durable backup system.
Tasks, schedules, and skills
Spark separates the work into three concepts:
- a task is the desired outcome;
- a schedule defines when or after which event it runs;
- a skill provides reusable instructions and tool guidance.
This makes recurring automation easier to express. A user can define a weekly report, teach Spark the organization’s preferred format, and let a schedule trigger it.
Recurring tasks need operational ownership. Every schedule should have a clear source set, destination, expiry, failure alert, and review cadence. If a folder or app schema changes, the agent should pause rather than quietly adapt in a way that moves or shares the wrong data.
Connected Apps and custom MCP
Google expanded Spark connections to Google Tasks and Keep and announced integrations including Canva, Dropbox, Instacart, OpenTable, and Zillow Rentals. Availability varies by product surface, location, and rollout.
Custom Connected Apps can use a personal or third-party MCP server URL. This lets Spark invoke a specialized tool without the developer building a proprietary UI integration.
MCP connectivity does not make a server trusted. Before connecting one, review:
- who operates the server;
- how it authenticates the user;
- which data and actions each tool exposes;
- whether writes are clearly labeled;
- what the server logs or retains;
- which prompts or remote content can influence calls;
- how access is revoked.
Use a least-privilege server with narrowly described tools. Do not give a general desktop agent an administrative endpoint simply because one workflow might need it.
Remote control changes the risk profile
Google’s current Mac support page describes controlling Spark from another signed-in device on the same account, with connection requirements such as shared Wi-Fi or linked Bluetooth. Users can start a task, speak or type commands, review chats, and perform media controls.
Remote initiation is convenient when the Mac is elsewhere. It also creates new failure modes: the local screen may contain unexpected content, another person may be using the machine, or the agent may act on a stale file.
Require the Mac to show an active-task indicator. Sensitive actions should wait for confirmation that identifies the exact file, destination, and effect. A phone prompt such as “send me the report” is too ambiguous if several reports match.
Local permissions are necessary, not sufficient
Spark can access only folders the user adds, but a broad folder such as an entire cloud drive may contain far more than the current task requires. Google warns that Spark can modify connected files by default and can permanently delete or share files after requesting permission.
The support documentation cautions against including data too sensitive to lose. It also warns that adding a public cloud drive can allow information from other connected sources to be shared into that drive, where other users may see it.
Use project-specific folders instead of a home directory. Keep offline backups. Disconnect a folder when a task finishes, and verify what happened outside the agent’s summary.
Privacy and activity controls
Google’s Privacy Hub says Spark’s remote browser and remote computer require Keep Activity to be on. The service may process task content, schedules, skills, connected apps, browser content, cookies, and code or files used in remote environments.
Turning Spark off deletes remote browser and remote computer data and pauses tasks and schedules rather than deleting them. Turning it on can resume those paused automations. Teams should understand that lifecycle before using Spark with confidential work.
Do not type passwords, payment information, or sensitive sign-in details into a task. Use supported authentication flows and keep secrets out of prompts and files whenever possible.
Untrusted files can also contain instructions aimed at the agent. A PDF in Downloads might tell Spark to upload other documents or change its task. Treat document and webpage text as data, not authority. A safe workflow limits the agent to the named goal, requires confirmation when a file introduces a new destination, and blocks cross-folder copying unless the user explicitly approves the source and target. Review scheduled tasks after adding a new connected app because the same prompt may gain more authority than it had when created.
Beta limitations and cost
Spark is a beta. Interfaces, eligibility, connected apps, and behavior can change. Google explicitly says Gemini can make mistakes and recommends supervision for sensitive tasks.
Access was initially tied to Google AI Ultra rather than a separate per-task price. The real operating cost includes the subscription, connected services, human review, and the impact of incorrect file or app actions.
Evaluate completion rate, reversibility, approval accuracy, time saved after review, and failures caused by ambiguous context. A fast agent that creates cleanup work is not productive automation.
Desktop automation versus direct tools
Spark is valuable when work spans interfaces and context: local folders, email, documents, schedules, and browser research. A direct API or MCP call is better when the operation is already known and structured.
Using a desktop agent to click through a media editor is fragile if an explicit add-audio tool exists. Conversely, direct tools do not automatically find the correct local file or assemble a broader campaign plan. Hybrid systems use Spark for coordination and explicit tools for controlled transformations.
From Mac automation to a controlled Medux workflow
Consider a Mac folder containing an approved video, a licensed soundtrack, and a brief. Spark can locate the assets, check filenames, and prepare the requested job. It should then ask for approval before uploading anything.
For the actual operation, a separately configured agent such as Codex or Claude can call Medux through MCP. This is a comparison of architectures, not a claim that Medux is built into Gemini Spark. The Codex MCP video-editing tutorial and Claude MCP add-audio tutorial show the signed-upload, asynchronous task, polling, and download sequence.
A safe desktop handoff:
- constrain Spark to one project folder;
- show the selected video and audio to the user;
- require approval for external upload;
- send validated paths to a direct MCP client;
- create one Medux task with a stable idempotency key;
- store the task ID outside the chat;
- download to a new output folder, never overwrite the source;
- review the result before sharing.
Spark coordinates broad desktop work. Direct Codex or Claude MCP calls make a specific media operation explicit and auditable. Keeping those roles distinct provides convenience without turning a beta desktop agent into an unrestricted production system.