Google Brings Gemini Spark to Mac With Local File Automation

Google has launched Gemini Spark for its macOS desktop app, giving Mac users a new way to automate tasks involving local files, folders, and desktop workflows. The update adds a dedicated Spark tab to the Gemini app sidebar, where users can connect selected folders and let the AI agent handle specific actions with permission.



Gemini Spark can work with files stored on a user’s computer, which makes it useful for tasks that usually take time when done manually.



Users can ask Spark to:




Sort PDFs from the Downloads folder into labelled subfolders



Pull figures from saved invoices



Create a Google Workspace budget spreadsheet



Set a schedule to update that spreadsheet regularly



Manage desktop tasks using only the folders they approve




Google says users can remove folder access at any time, and a future update will let them start Mac tasks from a phone.



More Apps Are Coming to Spark



Google has also added new Spark integrations for web and mobile, including Google Tasks, Google Keep, Canva, Dropbox, Instacart, OpenTable, and Zillow Rentals. These apps will let users turn Keep notes into task lists, design flyers, access files, order groceries, book tables, and reserve apartment tours.



The company is also adding custom MCP server support and real-time topic tracking for blogs, news, social media, finance, sports, shopping, weather, and email.



Gemini Spark for macOS is available in beta for Google AI Ultra subscribers aged 18 and above in the United States.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Google Brings Gemini Spark to Mac With Local File Automation
id: 2179fcd9-b059-4711-b736-ebb578acb214
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Google Brings Gemini Spark to " ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Google Brings Gemini Spark to Mac With L")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Google Brings Gemini Spark to Mac With L*"

CommonSecurityLog
| where Message has "Google Brings Gemini Spark to Mac With L"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc