Google Ads server for AI agents can change accounts
Four new write tools are on by default, but the guide of Google tells that the server is read only.
On 2 November 2026, Google released version 0.0.6 of its open source Google Ads server. The server links AI assistants to Google Ads accounts. It could only read data before, but it has four write tools. The tools make assets, upload videos and manage labels, and they are on by default. Google made no announcement of the change.
What is new
The tools make ad assets, such as text and images. They also upload videos to YouTube and manage labels. Campaigns, budgets, bids and keywords stay closed to the tools.
The safety step
Each write operates two times. The first step is a dry run. It gives a list of changes and a checksum. This code proves that the data did not change. A second step with the same data and checksum makes the change.
What is not known
Consultant Thomas Wismer tells that the server cannot check if a person approved the change. The wait for approval is only an instruction in the text of the tool. The published code shows that the checksum has no secret key and no expiry. The guide of Google, updated on 30 October, tells that the server is read only.
Insight: Google gives the hard stop to the customer
In October, the Data Agent Kit of Google had two controls. One is advice that an agent can ignore. One is an access rule that stops the tool. The Ads server has the same two parts, because its approval step is only an instruction to the model. In the two cases, Google gives the advice and the customer must add the hard stop. For leaders, your own access rules set what an agent can change.
Sources
Posted
