Gemini Connected Apps and Human Review of Drive and Gmail Data

A small GitHub repository titled "Gemini File Leaking Behavior" has drawn attention from developers and privacy-minded users. Its claim is straightforward: when Connected Apps is enabled in consumer Gemini, the assistant can retrieve personal files and emails in the background, and that content can then reach human reviewers. The repository is an independent write-up, not a Google publication, so treat its testing as a user's report rather than a confirmed audit. The policy changes it cites, however, are public and checkable.

What the repository says

The author points to a shift in Google's own messaging. When Gemini's Workspace extensions launched in 2023, Google said personal content from Gmail, Docs and Drive would not be seen by human reviewers. According to the write-up, an updated Google Help article and a later edit to the original announcement now say that connected Drive and email content can enter human review pipelines. The help text reportedly warns that a reviewer may see just the email or file, and advises users not to connect apps that hold confidential information they would not want a reviewer to see.

The second claim is about behavior. The author says retrieval can happen without an explicit @Drive or @Gmail tag. Casual mentions of a trip, a bill or a reservation reportedly trigger background lookups. Because tool calling in language models is probabilistic, the results vary from one run to the next. The repository describes four outcomes: no retrieval at all, a generic summary, a short exact excerpt, or full-file ingestion into the session context.

Why the probabilistic part matters

That variability makes this hard to evaluate. A single test that returns nothing proves nothing, and a single test that returns a document proves only that it can happen. The write-up itself notes that one clean run does not clear the pipeline. For anyone trying to reproduce the behavior, this means repeated trials, fresh conversations, and careful notes on which data sources were connected.

The reproduction steps are simple: enable Connected Apps, mention a topic that exists in your mailbox or Drive without asking for a file search, and then ask the model to show what its retrieval tool returned. Whether the model's answer to that last question reflects what was actually injected is itself something to verify with care, since a model describing its own context is not an independent log.

Context for developers

This is not unique to Google. Every assistant that connects to personal data faces the same tension: retrieval makes the product useful, while human review of conversations is a common practice for quality control and safety across the industry. The difference here is the reported reversal of an earlier explicit promise about Workspace content, and the claim that retrieval can fire without the user directing it.

For developers building on or around these systems, the lesson is practical. If your team's accounts hold client data, credentials, contracts or source material, an assistant with ambient access to them widens your exposure surface. Consider these steps:

• Review which apps are connected to Gemini and whether you need them connected at all.
• Check the activity and data-sharing settings tied to your account, including any controls over human review.
• Keep sensitive material in accounts or workspaces that are not linked to consumer AI features.
• Read the current Google Help page directly rather than relying on a secondhand summary, since the wording can change.

What to watch

Three things are worth following. First, whether Google responds publicly to the specific claim that retrieval occurs without explicit tagging, and what controls it offers to disable it. Second, whether independent researchers can reproduce the four retrieval states with logs rather than model self-reports. Third, whether Workspace administrators gain clearer, enforceable settings for organizational accounts, which are governed by different terms than consumer ones.

The repository is young, with a handful of commits and a few dozen stars, and its evidence is anecdotal. That does not make the policy text it cites any less relevant. If you use Gemini with connected accounts, the cheapest action is also the most direct: read what you have agreed to, and decide whether your most sensitive files belong within reach of the assistant.