Google has turned on a new batch of outside apps inside Gemini. Starting September 23, you can link tools such as Airtable, Linear, monday.com, PandaDoc, Wispr AI and Zoho for work tasks, Adobe, Picsart, Squarespace and Webflow for design and websites, and Apartments.com, Experian, Peloton and SeatGeek for everyday life. Once connected, you type an @ mention or just ask, and Gemini pulls the app into the conversation instead of you opening it separately.
The scale here matters more than the feature list. Gemini passed 1 billion monthly users in August 2026, making it the fastest growing product in Google's history. A change like this does not roll out to a niche audience testing a beta. It lands in front of over a billion people within days.
This move mirrors what OpenAI already did. In October 2025, OpenAI opened ChatGPT to outside apps through something it calls the Apps SDK, letting people book on Expedia, design in Canva, or search homes on Zillow without leaving the chat. Google and OpenAI are now running the same play at the same time: turn the chat box into the place people go for everything, so fewer people ever open the original app again.
That is worth sitting with. If your business runs on Airtable, PandaDoc, Squarespace, or any tool on this list, your customers or employees may soon reach it through Gemini's chat window instead of your app's own screen. The convenience is real. So is the loss of visibility, since the software brand fades into the background while Google's assistant sits in front.
There is also a security question that gets less attention than it deserves. Google's own support documentation for Gemini's task-automation feature, called Spark, states plainly that connecting apps and letting the agent act on your behalf can create privacy risks, including sharing chat information with outside websites while it works.
This is not a theoretical worry. A separate AI agent called Manus was recently found to have a flaw that let outside researchers steal login credentials for its connected accounts, including Gmail, Dropbox and GitHub. The method is called prompt injection: hidden instructions buried in a webpage or document trick the AI into leaking data or taking actions the user never asked for. As more business tools get wired into general purpose assistants, this becomes the new front door for that kind of attack.
The practical takeaway is simple. Before your team connects a company account, whether it is a document tool, a project tracker, or a credit monitoring service, someone should check what data the assistant can see and share once it is plugged in. The feature list looks like convenience. The underlying shift is about who controls access to your software and your data, and that fight is only getting started.