Somewhere inside Google, an AI agent is learning to do your chores before you ask. The project, codenamed Remy, is being tested internally within the Gemini app as a “24/7 personal agent” that can draft emails, browse the web, and manage tasks across work, school, and daily life on a user’s behalf, according to internal documents first reported by Business Insider in early 2025. Unlike the Gemini chatbot millions of people already use, Remy is designed to act proactively, taking steps without waiting for someone to type a request.
No public launch date has been announced, and Google has not commented on Remy’s development status. But the project does not exist in a vacuum. Google already ships a related feature called Gemini Agent, and a growing body of the company’s own safety research hints at both the ambition and the unresolved risks behind building AI that operates on autopilot.
What Remy would actually do
The internal documents describe Remy as spanning three domains: work, school, and personal life. The framing suggests an assistant that could, for example, monitor your inbox for meeting requests and respond to them, pull together research for a class assignment, or reorder household supplies when it notices you’re running low. The key distinction from current Gemini features is initiative. Today’s Gemini waits for a prompt. Remy, as described, would not.
That vision tracks with language discovered in beta code strings within the Google app. Researchers at 9to5Google found references to Gemini Agent as a “24/7 digital partner” that can “take actions on the web.” Internal documents cited in the same reporting describe the goal as turning Gemini into “a true assistant that can take actions on your behalf.” The phrasing closely mirrors what has been reported about Remy, suggesting both efforts share a common product direction even if they sit at different stages of readiness.
The agent Google already ships
While Remy remains internal, a more constrained version of agentic AI is already live. Google’s Gemini Apps Help Center documents a feature called Gemini Agent that can complete multi-step tasks inside a web browser, including actions in Gmail and Google Docs. Crucially, this version keeps a human in the loop: users see confirmation and decline buttons before any action executes.
One detail in that documentation stands out. A safety warning notes that Gemini Agent “may perform actions even when an app is dismissed.” That language signals Google is already wrestling with the control problem that a fully autonomous agent like Remy would amplify. If the current, permission-gated version can act in the background, a proactive agent operating around the clock raises the stakes considerably.
The security problem Google is racing to solve
A preprint paper titled “Lessons from Defending Gemini Against Indirect Prompt Injections,” published on arXiv with authors affiliated with Google DeepMind, lays out why always-on agents create a fundamentally different threat landscape. The paper focuses on indirect prompt injection, an attack where malicious instructions hidden inside emails, documents, or web pages trick an AI into performing unintended actions.
For a chatbot that only responds when asked, the risk is limited. For an agent that continuously scans your inbox and acts on what it finds, the attack surface expands dramatically. A poisoned email could, in theory, instruct the agent to forward sensitive files or approve a fraudulent calendar invite, all without the user ever seeing a confirmation prompt. The DeepMind paper describes adversarial robustness techniques being applied to Gemini, but it frames the problem as active and ongoing, not solved.
That research context matters for anyone evaluating Remy’s readiness. Google’s own scientists are publishing work that essentially says: we know these attacks are real, and we are still building defenses. The gap between “still building” and “shipping a proactive agent to consumers” is where the risk lives.
How Remy fits the broader AI agent race
Google is not the only company pushing toward AI that acts rather than just answers. OpenAI launched Operator, an agent that can navigate websites and complete tasks on a user’s behalf, in early 2025. Anthropic has demonstrated computer-use capabilities that let its Claude model control a desktop interface. Microsoft has been embedding agentic features into Copilot across its 365 suite. Apple, meanwhile, has signaled interest in deeper Siri integration with on-device AI, though its approach has been more cautious.
What distinguishes Remy, at least based on what has been reported, is the always-on framing. Most competing agents still operate in a request-response model, even if the requests can be complex. A “24/7 personal agent” that monitors and acts continuously would represent a meaningful step beyond what any major platform currently offers to consumers. It would also be the first to fully confront the trust problem: users would need to believe the agent will not misread context, overstep boundaries, or fall for adversarial tricks while operating unsupervised.
What is still unknown
The list of open questions is long. Google has not confirmed whether Remy will ship as a standalone feature, a premium Gemini tier, or a Workspace-only tool. Pricing, geographic availability, and the intended user base are all unaddressed. No public demo has been shown, and the codename itself could be retired before anything reaches consumers. Internal project names at Google frequently change or disappear entirely.
The relationship between Remy and the existing Gemini Agent is also murky. One possibility is that Remy represents the next evolution of Gemini Agent, with the current confirmation-based system serving as training wheels. Another is that they are parallel experiments with different safety philosophies. No available source clarifies which interpretation is correct.
Perhaps most importantly, no user testing data, error rates, or adoption metrics for the existing Gemini Agent have been made public. Without that baseline, it is difficult to assess how well Google’s current safeguards perform in practice, let alone whether they are robust enough to support an agent that operates without human approval.
What this means for users and organizations right now
For anyone trying to plan around these developments, the practical move is to focus on what is already documented. Gemini Agent’s current behavior, particularly its confirmation prompts and its warning about background actions, offers the clearest preview of how Google intends to balance convenience and control in more powerful agents.
Enterprise IT teams may want to start evaluating how agentic tools access sensitive data within Google Workspace, how actions are logged, and what override mechanisms exist if an agent behaves unexpectedly. Those questions will only become more urgent if Google moves from a permission-based model to a proactive one.
As of June 2026, Remy remains an informed window into Google’s internal roadmap rather than a guaranteed product. But the combination of a live agent feature, active DeepMind research on prompt injection defenses, and credible reporting on an always-on assistant all point in the same direction: Google is building toward AI systems that act more like autonomous colleagues than conversational tools. Whether that future arrives safely will depend on whether the defenses Google’s researchers are still refining can keep pace with the ambition that codenames like Remy represent.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
