If your business, or your clients, run on Google Workspace, AI agents just became coworkers. Literally.
At Gemini at Work 2026, Google introduced the Gemini agent, a single agent for work that can run multi-step jobs in the cloud and keep going after you close your laptop. Google also described coworker agents: agents with a defined role, such as a launch coordinator or a financial analyst, that teammates can add to a Chat space or @mention in a Doc. According to Google, each coworker agent gets its own Workspace account, with an @agents email address, Drive storage and a place in the directory.
That’s a smart design. It also means every Gemini agent is now an identity in your Workspace, with sign-ins, permissions and data of its own. This post explains what that means for security, what Google gives admins, where the gaps are, and what to check first.
What’s changing in Google Workspace
Three things are new, and each changes the security picture:
- Agents have their own accounts. Google says managing coworker agents is like managing users, because each one has a Workspace account. That’s good for audit trails. It also means agent accounts need the same care as people’s: ownership, access reviews and offboarding.
- Agents do long-running work on their own. A job that runs for hours while nobody watches is exactly where unusual behaviour goes unnoticed.
- Agents read what you read. Gemini works with your mail, calendar and Drive. Anything it reads can carry instructions, and that has already been exploited.
The calendar invite that told Gemini what to do
In January 2026, researchers at Miggo Security reported that a hidden instruction in a calendar invite’s description could make Gemini leak private meeting details. The victim didn’t have to click anything or even open the invite. The instruction sat there until they asked Gemini an ordinary question, such as whether they were free on Tuesday. Then Gemini followed it, and put a summary of private meetings into a new calendar event the attacker could see, depending on the organisation’s calendar sharing settings.
Google confirmed the findings and mitigated the issue. But the lesson stands for every AI agent, on every platform: an agent can be steered by what it reads. You can’t rely on the agent always refusing. You need to control what it can reach, and notice when it does something unusual.
What Google gives admins
Google has built real controls into Gemini Enterprise and the agent platform beneath it. According to Google:
- Agent Identity: each agent gets a cryptographic identity for clear audit trails, and can be given narrow permissions.
- Agent Gateway: agent traffic to outside services is routed through a gateway where admins can enforce policies.
- Agent Registry with default deny: on Google’s agent platform, connections from agents to tools and endpoints are blocked unless a policy allows them.
- Model Armor: scans prompts and tool responses for prompt injection and data leakage.
- Agent anomaly detection: announced at Google Cloud Next ‘26 to spot tool misuse and unauthorised data access.
- Workspace admin controls: admins can switch Gemini Enterprise on or off and set which users can use agents, and Workspace domain policies apply to agent data access.
Use them. Much of this is new, so check Google’s current documentation for what’s available in your edition.
Where the gaps are
Even with Google’s controls, most businesses and MSPs still have four gaps:
1. Agents outside Gemini
Gemini agents aren’t the only agents in a Workspace tenant. Third-party AI apps connected through OAuth consent, note-takers, and agents from other SaaS tools all hold access to Gmail and Drive. They need to be on the same list.
2. Agents that inherit oversharing
A coworker agent added to a shared drive can read whatever that drive holds. If a folder of salary reviews was shared with the whole domain years ago, the agent can surface it. Google’s controls govern the agent; they don’t clean up old sharing.
3. Ownership over time
An agent account created by a team lead still needs an owner when that team lead leaves. Agent accounts that look like user accounts are easy to miss in offboarding.
4. One view across Microsoft and Google
Many businesses run both. Marketing in Workspace, finance in Microsoft 365. An MSP has clients on each. Agent security that lives in one admin console at a time leaves the joins unwatched.
A worked example: the analyst agent and the board pack
This is an illustrative example, not a real client. A 60-person design agency runs on Google Workspace. The operations lead creates a Gemini coworker agent to prepare weekly financial summaries and adds it to the finance shared drive.
- The shared drive contains a “Board” folder that was shared with the whole domain two years ago for an all-hands meeting. The agent can now read the board pack, including a confidential acquisition plan.
- A junior designer @mentions the agent in a Doc and asks for “the latest numbers”. The agent helpfully includes figures from the board pack.
- Three months later, the operations lead leaves. Their user account is suspended. The agent’s account isn’t, because it’s a separate account nobody linked to them.
With agent controls in place: the domain-wide sharing on the Board folder is found before the agent is added, the agent’s access is limited to the summaries folder, and the agent has a named owner who’s reviewed when the operations lead leaves.
Checklist: Gemini Enterprise agent security
Before you switch agents on
- Decide which users can create and use agents.
- Find files and folders shared with the whole domain or by public link, especially in finance, HR and leadership drives.
- List third-party AI apps that already hold OAuth access to Gmail, Drive or Calendar.
For every agent
- It has a named human owner who’s still with the business.
- Its access is limited to the drives and data its job needs.
- It’s reviewed at least every 90 days.
- It’s included in the offboarding of the person who owns it.
Ongoing
- Unusual agent activity, such as reading far more than normal, raises an alert.
- Calendar sharing settings are reviewed, given the invite-based attacks.
- New OAuth grants to Workspace are reviewed.
- Any agent or app can be cut off in one step.
How Centeye helps
Centeye Synthwatch covers Google Workspace and Microsoft 365 side by side. Today it lists the AI agents and AI apps holding access to Gmail, Drive and Calendar through app grants, gives each one an owner and a 90-day re-approval, reads what each grant allows with a risk score, finds oversharing an agent could surface, and traces app-to-app chains. It can revoke a grant or reset a token at the setting you choose.
Synthagent, the guard agent inside Synthwatch, watches every agent’s identity, authentication, grants and connections continuously, and links an agent going off script to its owner’s account and mailbox in one case. Centeye Gatewatch watches every sign-in across Google Workspace, so a takeover of an agent’s owner is caught too.
Reading agents straight from the Gemini Enterprise registry and Google’s agent identities is coming. Synthwatch and Synthagent are in early access, and work across every client tenant for MSPs.
Frequently asked questions
Do Gemini agents have their own accounts?
According to Google, coworker agents each get their own Workspace account, with an @agents email address, Drive storage and a directory presence, and they act under that identity rather than the user’s.
Is Gemini Enterprise safe for business data?
Google provides strong controls, including agent identity, a gateway for agent traffic and prompt-injection scanning. The biggest remaining risk is usually what the agent can reach: old sharing, broad drive access and third-party apps with OAuth grants.
What was the Gemini calendar invite attack?
Researchers at Miggo Security showed in January 2026 that hidden instructions in a calendar invite could make Gemini leak private meeting details without the victim clicking anything. Google mitigated it.
How do I offboard an agent in Google Workspace?
Treat it like a user account: give every agent a named owner, include the agent in that owner’s offboarding, and suspend or reassign it when they leave.
Should MSPs treat Gemini agents differently from Copilot agents?
The same four layers apply: identity, authentication, grants and connections. The admin consoles differ, which is why one view across both helps. See how to secure the control plane behind Copilot Studio and Foundry agents.
New to the terms? See AI agent, OAuth grant and shadow AI in our glossary. Want to see the agents in your Workspace? Ask for early access.
Gemini agent and coworker agents as described by Google at Gemini at Work 2026. Agent Identity, Agent Gateway, Agent Registry, Model Armor and agent anomaly detection as described in Google Cloud documentation and announcements, including Google Cloud Next ‘26. Calendar invite research by Miggo Security, January 2026, as reported by TechRepublic and others; mitigated by Google. The worked example is illustrative. Synthwatch and Synthagent are in early access. Google, Google Workspace, Gemini and Gemini Enterprise are trademarks of Google LLC.