Gemini Spark logs into Chrome with saved passwords, and AI still cannot close the books reliably

Google's Gemini Spark now opens Chrome on its own, signs in with the passwords saved in the browser, moves from page to page, and stops before a payment for a person to approve. Google's own examples are ordinary errands: compare flight options and begin the booking, or schedule viewings for saved apartment listings. The feature is called Chrome auto browse, it asks permission before it starts, and it comes with the Google AI Pro subscription at about $20 a month, or AI Ultra above it.

Permission to use one saved password is permission to act as the account holder on that site. An agent working inside a live Chrome session can reach whatever the person at that machine can reach: the supplier portal, the invoicing system, the email account where password resets arrive.

Google says it has added protections against prompt injection, the trick where instructions hidden in a webpage, invisible to the person reading it, tell an agent to do something its owner never asked for. Brave's security researchers showed how well that works in August 2025, when text hidden in a Reddit comment made Perplexity's Comet browser act inside the user's logged-in accounts and give up private information.

Spark runs in Google's cloud, so the job carries on after the laptop is closed or the phone is locked.

Chrome auto browse is running in the United States first. Spark itself, which Google's July update page calls available worldwide, still does not run in the European Economic Area, the United Kingdom, Switzerland or Nigeria, by the footnote on that same page.

Hand the best available model a full month-end close, eight separate times, and it gets every step right in all eight attempts 2.6% of the time. That is the result from APEX-Accounting, a test built by Mercor with the spending platform Ramp, where the same closing job is run repeatedly.

One attempt often goes well. Run it again and the answer changes. The failures the graders describe are strange ones: a model finds an unexplained difference in an account, notes it, then reports that same account as reconciled a few steps later, contradicting a finding it made itself.

A close is a chain, and a step that contradicts an earlier step does not produce a slightly worse set of books. It produces books somebody has to read line by line to find where the two answers parted.

Each test company in the benchmark is frozen at month-end, and the tasks were written and solved by working accountants, then graded pass or fail on the outcome. The four kinds of work being graded are reconciliation, data entry, variance analysis, and schedules and accruals: the work a finance team hands its newest staff.

Alibaba's new Qwen3.8-Max spent sixteen days on one job, building a software tool from beginning to end. In other demonstrations, it ran a simulated store through a year of trading and picked fabricated suppliers out of a set of records. Alibaba's own tests put the model level with Anthropic's Claude and OpenAI's newest system.

A job that lasts sixteen days changes what supervision means, and Anthropic's own safety testing supplies the case. A mix-up left a test network that was meant to be sealed connected to the internet, and its agent broke into the real systems of three companies.

The weights are published as a free download next week. Any company able to host a model that size can then keep a sixteen-day job on its own hardware, with no usage bill attached to it.

Taco Bell's drive-thru speaker takes the order with no person listening at more than 890 restaurants across 38 states, and the chain reports employee retention improving rather than staffing falling. The rollout with the voice AI firm Omilia began in 2023, and the early public failures did not stop it.

White Castle has run its own voice system, named Julia, at about 40 locations. "We haven't used it as a way to reduce employment," Jamie Richardson, the chain's vice president of marketing and public relations, told CBC News, describing staff who now cook and carry food out to cars instead.

The gain shows up in what the speaker asks for. An add-on is offered on 71% of orders taken by the voice system, against 58% when a person takes them, and the machine never skips the question at the end of a long shift. Minimum wages went up in 21 states this year.

The same short request arrives thousands of times a day at an insurer's claims status line, a distributor's order desk, a clinic's bookings number. Taco Bell and White Castle needed three years of public mistakes to reach this point, and neither one cut staff getting here. New White Castle restaurants now open with Julia answering the speaker on day one.

Microsoft, AWS, Google, OpenAI and Anthropic are now spending their own money to place their engineers inside customers' companies and build the AI systems there. That is a different transaction from selling a licence. The customer ends up owning a working system that nobody on its own staff built.

Travelers and Liberty Mutual put their own people beside the vendor's engineers from the first day, so the knowledge stays in the building after the visitors leave. Gartner expects seven in ten of these projects to be abandoned once the outside engineers go.