Let’s break down the planning doc it generated to better understand how Gemini Spark works. The first section was an event overview, listing the exact date, address, and reservation details it pulled from my email. This even included the last four digits of the credit card I used to put down the $50 deposit.

My prompt to the bot wasn’t very detailed, so my expectations were low going in. I had expected it to whip up a random birthday plan from my vague request, not to uncover the real party hidden in my emails.

The AI-generated birthday itinerary also included nearby restaurants, complete with phone numbers to call for reservations. When I asked Gemini Spark to try to book the dinner reservations for me, it attempted to complete the request but glitched out.

It operated a remote browser as part of its efforts, even triggering a six-digit verification number to be texted to my phone, but was unable to complete the task even after I asked different ways. I ended up just calling the sushi place to save some spots.

Next up was the post-party plan, where Gemini Spark had exclusively listed gay bars to hit up afterwards. The dive queer bars are where I’d probably actually go, sans AI suggestion, so I was curious how Gemini Spark picked these. It felt like I was being profiled and wanted some answers about why this plan was so, well, gay.

“The system does not make inferences about your personal identity. Instead, it scans your files and emails for exact keywords, past itineraries, and transactions,” read Gemini Spark’s response. “The suggestions of those specific venues (like Toad Hall and OASIS) and guest lists (from Stonewall Sports and the Sons of Pitches roster) were chosen simply because those exact names, events, and locations are recorded directly in your Google Workspace history.” Spark listed specific emails and travel documents, ones that I didn’t even remember existed, as the source material backing these selections. Gaggy.

The example email it drafted to send to party guests went in-depth on the venue rules, striking the wrong tone for a laid-back night of singing Chappell Roan songs. (No one at my 32nd birthday party is going to be under 21, so why is Spark scolding everyone about minimum age requirements?) I asked the agent to rewrite the email using a more casual tone, then send a test to my boyfriend’s email. After confirming that I approved of the wording, Gemini Spark automatically shot off the message.

In addition to the boilerplate AI disclaimer at the bottom of the Gemini Spark page, Google recommends extra caution for users who might want to try connecting the agent to their data. A known issue with AI agents is how the tools make you vulnerable to prompt injection attacks, where bad actors essentially trick your agent into doing bad stuff with the data it has access to.

Google’s help page offers this example: “A malicious instruction could tell the agent to take your private info from your emails or documents and post it on a public website, send your emails in Gmail to an external service without you knowing, expose insights about you based on your data in connected apps.” That disclaimer alone should be enough reason for most users not to try Gemini Spark. Imagine the most sensitive info from your Gmail plastered all over the internet. What a nightmare. I can’t even recommend curious early adopters give Spark access to their entire inbox, since it could open them up to potential security breaches.

My birthday party experiment only gave me a small taste of Gemini Spark’s full automation capabilities. Users can also schedule repeating tasks and upload unique skills to Spark, like mimicking your tone of voice when it composes emails for you. Even so, my birthday itinerary captured two fundamental aspects of these types of AI agents.

First, the more personal data you hand over to these AI tools, the more hyper specific they can be in their outputs. I didn’t have to tell the agent I already had started planning the party; it simply scraped all the info it needed. Even so, this type of access still opens up the door for potential security breaches.

Second, these agents can be so technically “smart” thanks to their powerful AI models and still lack any kind of common sense. I pressed Gemini Spark again for what it thought about my boyfriend. “Your shared housing, mutual account recovery, and shared travel records show you are close daily companions,” read its answer. Gemini Spark declined again to define the relationship. So, even after I gave the agent everything, I still felt like it barely knew me.