On July 30 Google announced that Gemini Spark, its personal agent for errand-level tasks, can now use desktop Chrome on your machine. With permission, it browses through your logged-in accounts, signs in using credentials stored in Google Password Manager, compares fares, fills in traveler details, and pauses for your explicit approval before anything sensitive, including payment. It’s in preview for AI Pro and Ultra subscribers in the US on Windows, macOS and Chromebook Plus, and it shipped the same day Spark expanded to more than 160 additional countries.
The coverage split into two piles: convenience-feature writeups and password-security worry. Both fair. But if your job involves selling anything on the other side of that browser, the detail worth sitting with is where this agent lives. It doesn’t call your API. It doesn’t show up as a partnership with terms. It drives the customer’s own Chrome, with the customer’s own cookies, from the customer’s own IP address.
I spent years at Fastly in rooms where customers planned their bot defenses. The entire discipline rested on one assumption: a bot is an outsider you keep away from the real users. Scrapers, sneaker bots, credential stuffers. Nobody planned for the bot that arrives as the real user, holding a password the customer handed it on purpose.
The defenses were built for agents that knock
Watch how retailers handled the first wave of agentic shopping. Walmart tried OpenAI’s Instant Checkout, saw conversion come in around three times worse than its own site, pulled out, and embedded its own Sparky agent inside ChatGPT and Gemini instead. Amazon kept outside agents away from its store entirely. Both strategies work at the platform boundary: decide which agents get in, on what terms, with what data flowing back.
Spark doesn’t present itself at that boundary. From walmart.com’s side of the connection, a Spark session is a returning customer on Chrome, signed into their account, loyalty history attached, saved addresses ready. The negotiation Walmart won against OpenAI, keeping the customer record and the checkout, doesn’t come up here, because there is no counterparty to negotiate with. Google put the agent inside the customer.
Google says Auto Browse asks before sensitive actions and that Password Manager assists sign-ins without handing raw passwords to Gemini. What Google hasn’t said is whether the sites being browsed get any signal that a session is agent-driven. Until that answer exists, retailers should assume they can’t tell.
Retail media is priced on a human being looking
US retail media runs on sponsored placements, and more than 60% of the spend is sponsored search, promoted listings sold on the premise that a shopper’s eyes pass over them on the way to a decision. An agent comparing three flights or four moisturizers on assignment doesn’t linger on an endcap banner. It extracts price, availability and specs, and moves on. The impression still fires. The invoice still goes out. What’s gone is the attention the invoice was pricing.
Personalization has the same exposure one layer down. Recommendation models train on browsing behavior as a proxy for interest. A Spark session browsing twelve product pages in ninety seconds on a filtering errand writes noise into that model under the customer’s identity. The retailer’s data science team will see engagement. What happened was retrieval.
This is a preview feature for a slice of US subscribers, so none of this moves a P&L this quarter. That’s the window. The measurement questions are cheap to answer now and expensive to answer after an advertiser’s analyst finds the drift on their own.
What to do while it's still small
If you sell retail media: get your engineering and measurement teams to a position on agent-session detection before your advertisers bring it to a QBR. Session cadence, page-dwell patterns and interaction shape can flag agent-like behavior even without a header from Google. You don’t need to solve billing policy yet. You need to be able to say what share of monetized sessions look automated, because the first RMN that reports it honestly turns a threat into a trust story.
If you buy it: pull impression and conversion trends on your biggest logged-in retail partners and watch the ratio. Agent-driven sessions should show up as impressions that convert without the browse behavior that used to precede a purchase. And start asking your RMN partners the detection question in writing. The answers will be vague this quarter. Keep the vague answers; they’re your negotiating file for next year’s rate conversation.
The shopper who trusts an agent with their saved passwords is telling you something too: they wanted the errand done, and nothing about your shelf, your banner or your carousel was part of what they wanted. That preference existed before Spark. Google just built it a driver’s seat.