Gemini Enterprise & Managed Agents: Security Review

Completing the trilogy — after ChatGPT Work and Claude Cowork and Claude Code, here is the honest security review of Google's agent stack: Gemini Enterprise, and the Managed Agents platform that got a substantial governance upgrade on July 28. The headline is a genuine split decision: Google ships the best agent identity architecture of any hyperscaler — and its enforcement hooks cannot see the tools where exfiltration actually happens. Both halves deserve the full treatment.

Last verified: August 20, 2026. Several features below are Preview-status and moving; reverify against Google's docs before locking policy.

What you're actually approving

Three distinct things travel under the Gemini name, each with its own risk profile: Workspace Gemini (the assistant inside Docs, Gmail, Sheets — grounded in your tenant data), Gemini Enterprise / the Agent Platform (build-and-run infrastructure for production agents, with governance features), and Managed Agents in the Gemini API (sandboxed autonomous agents developers spin up — now including a free tier, meaning no billing gate stands between a developer and an agentic sandbox). Approving "Gemini" without naming which one is how governance gaps start.

Credit where due — and some of it is genuinely best-in-class

Agent identity done properly. Every deployed agent gets a SPIFFE identifier with an identity token cryptographically bound to the agent's X.509 certificate via mTLS, auto-rotated every 24 hours — stolen tokens are unreplayable, actions are signed and traceable, and agent identities work as IAM principals. This is the strongest first-party answer yet to the agents-logging-in-as-humans problem, and other platforms should copy it.
Hooks with deny verdicts. Since July 28, pre- and post-execution hooks can inspect tool calls inside the agent sandbox and return {"decision": "deny"} with a reason — a real enforcement primitive, not just logging.
Hard budgets. max_total_tokens caps a run and pauses it with state preserved — a genuine blast-radius control.
Compliance posture. FedRAMP High (first productivity-suite genAI to get there), ISO 42001, HIPAA-eligible surfaces under BAA, CMEK/VPC-SC options, client-side encryption that Gemini structurally cannot read.
Fast patching. The Gemini CLI command-injection flaw (CVE-2026-12537 — a CVSS 10.0 allowing pre-sandbox host code execution from a malicious repo file in headless CI) was fixed in 0.39.1.

The six risks that survive

1. Hooks don't cover MCP tools — the gap that matters most

The hooks fire only on tools Google runs inside the container: code execution and file operations. Remote MCP servers and client-side custom functions run outside it — and are therefore invisible to the enforcement layer. The channel through which an agent reaches your databases, APIs, and third-party services is precisely the one the deny verdicts can't touch. Every hardening plan for this platform starts from that sentence.

2. The policy engine is an LLM judging an LLM — in Preview

Semantic Governance Policies is a genuinely novel idea: plain-English constraints, evaluated against every proposed tool call, returning ALLOW or DENY with a human-readable rationale. It is also Preview-status, probabilistic by Google's own admission ("verdicts may not be accurate"), without VPC-SC support, and its denial rationales can themselves leak policy details. An LLM policing an LLM inherits the attack surface of both. Use it — as one layer, never as the layer.

3. Scheduled agents are unsupervised recurring workers

Cron triggers bind agent + environment + prompt into a persistent resource that fires autonomously, with sandbox state carrying over between runs — which means poisoned context persists too. The auto-pause activates after consecutive failures; a run that succeeds at doing the wrong thing never trips it. Combine with the MCP hook gap and the free tier, and you get the review's sharpest finding: a recurring, unsupervised, un-hooked agent anyone can create without a purchase order.

4. Grounding amplifies your permission debt

Google's own security documentation concedes it: Gemini surfaces whatever the user can already access. Same disease as Copilot oversharing — a decade of broad sharing, now with a conversational interface. Drive trust rules, IRM, and CSE are real mitigations, and almost nobody has turned them on.

5. The injectable surface has a track record — including a won't-fix

The record to know: calendar-invite promptware demonstrated at Black Hat 2025 (patched, but the class persists — a January 2026 follow-up found calendar-data exfiltration); the Gemini-in-Chrome chain in this year's zero-click agentic-browser research achieved full machine takeover via localhost access; a malicious-extension panel hijack (CVE-2026-0628); and ASCII smuggling, which Google declined to fix, classifying it as social engineering. That last one means a known invisible-instruction channel into Gemini remains open by design — your inbound content inspection has to own it.

CVE-2026-12537's lesson generalizes: agent tooling can execute before the sandbox exists. Pin CLI versions (≥0.39.1), never auto-trust workspace folders in automation, and treat repo files as untrusted input to your build agents.

The hardening checklist

Enable hooks with default-deny on write and execute classes — then treat everything MCP as outside the moat: route agent MCP access through gateway policy and independent inspection, because Google's controls end at the container wall.
Layer SGP as advisory defense-in-depth, not primary enforcement, while it is Preview.
Put a human checkpoint on scheduled-trigger outputs; review trigger inventory weekly — including free-tier usage by developers.
Set max_total_tokens budgets on every agent; alert on pause events.
Run the Drive/IRM/trust-rules cleanup before enabling broad grounding — the Copilot oversharing playbook applies verbatim.
Ingest Gemini access logs (Reports API) and agent action logs into the SIEM; Vault for retention.
Pin Gemini CLI in CI; disallow auto-trusted workspaces; treat Gemini-in-Chrome as an agentic browser subject to your AI-browser policy, not a browser feature.

Verdict

Approvable, with the same coda as the rest of the trilogy: Google has done more identity homework than anyone and less enforcement-coverage homework than its own marketing implies. The controls that close the real gaps — MCP-layer inspection, cross-platform policy, independent audit of what agents actually did — are the deployer's to run. Approve the platform; own the governance; and if you run all three vendors' agents (most enterprises now do), note that three first-party consoles still don't answer "what did our agents do this week?" — that cross-platform layer is the part we build.

FAQ

Is Gemini Enterprise safe for regulated data?

The compliance ceiling is high — FedRAMP High, BAA-eligible surfaces, CMEK, CSE. Safety in practice depends on the grounding cleanup and the MCP governance you add; certifications cover the platform, not your permission sprawl.

How does it compare to ChatGPT Work and Claude?

Identity: Google leads outright. Inline enforcement primitives: Anthropic's inference hooks cover more surface (including tool responses) but are also newer. Admin action-gating: OpenAI's preauthorization is the most mature. Deployment posture matters more than vendor choice — and running two or three of them is the argument for governance that spans them.

Should we block Gemini-in-Chrome?

Treat it under your agentic-browser policy. It appeared in this year's zero-click hijack research with the most severe demonstrated outcome (machine takeover via localhost); Gartner's standing advice on agentic browsers is block-for-now. If you allow it, allow it deliberately, with the mitigations above.

What's the single highest-leverage control?

Independent inspection of agent MCP traffic. It is the one surface the platform's own enforcement explicitly does not cover, and it is where the data actually moves.

Sources: Google — Managed Agents update (Jul 28, 2026) · Google Cloud — Semantic Governance Policies (Preview) · Google Cloud — Agent Identity · Workspace Gemini enterprise controls · FedRAMP High · CVE-2026-12537 advisory · SafeBreach — calendar promptware · Zero-click agentic-browser research (Black Hat 2026) · FireTail — ASCII smuggling · Unit 42 — CVE-2026-0628.

Gemini Enterprise and Managed Agents: The Security Review