weights.bin in Chrome: What Google’s Silent 4GB AI Download Really Is

If you went looking through your Chrome profile folder and found a file called weights.bin taking up roughly four gigabytes, you are not alone, and you did not get infected with anything. Chrome downloaded Google’s on-device AI model onto your machine without asking, and the discovery of weights.bin set off a wave of posts calling it spyware.

The coverage since then has split into two camps, and both are wrong. One says Chrome silently installed surveillance software. The other says there is nothing to see here. The accurate answer sits in between, and the part that actually deserves attention is the part almost nobody wrote about.

What Is weights.bin in Chrome?

The weights.bin file is Gemini Nano, Google’s small on-device AI model. Chrome runs it locally so that certain AI features work on your own hardware instead of sending the work to a server.

Those features include scam and phishing detection, writing assistance, summarization and some AI-assisted autofill and suggestions. Google has said the model has been offered since 2024 as a lightweight on-device model powering security features, and that no data is sent to Google or any third party when the model is used.

Running the model locally is genuinely the more private design. The work happens on your machine, and the page content being analyzed does not have to leave it.

Why It Showed Up Without Asking

Chrome downloads the model automatically once two things are true: your device clears a hardware bar, and you interact with a feature that uses the on-device AI APIs. There is no consent dialog and no notification.

The hardware gates are why the file did not land on every machine. Chrome checks for a GPU with more than four gigabytes of video memory, or a processor with at least sixteen gigabytes of system RAM and four or more cores, plus at least twenty-two gigabytes of free space on the drive holding your Chrome profile. Supported systems are Windows 10 and 11, macOS 13 or later, Linux, and Chromebook Plus devices.

That gating matters for a claim you will see repeated online. This did not hit every Chrome user on earth. It hit desktop machines that met the bar and triggered a feature, which credible reporting puts in the hundreds of millions rather than the billions.

Is weights.bin Malware or Spyware?

No. There is no technical evidence that weights.bin is malicious or that it exfiltrates data, and security vendors that examined the situation reached the same conclusion.

It is worth being precise about this, because the panic did real damage to the more important conversation. A large binary like weights.bin appearing in a profile folder without warning looks alarming, and the name gives away nothing to a non-technical user. But an unexpected file is not the same as a malicious one, and the evidence for the spyware reading never materialized.

The legitimate complaints are narrower and still valid: no consent, no notification, four gigabytes of disk consumed, and a large download on a connection the user may be paying for by the gigabyte.

The Real Security Concern Nobody Covered

Here is the part worth your attention. The weights.bin file is not the threat. The capability it switches on is a new attack surface, and that distinction is the whole story.

An AI model sitting inside the browser reads untrusted content from web pages while living next to browser privileges. Security researchers have already demonstrated what that enables. Gemini Nano itself has been successfully prompt-injected in published research, with testers finding the model too trusting as a side effect of its safety training. Separate work has shown indirect prompt injection quietly poisoning Gemini’s context through channels the user never sees.

The browser integration produced a concrete vulnerability too. Palo Alto Networks Unit 42 disclosed a flaw, tracked as CVE-2026-0628, that let a browser extension holding only basic permissions inject into the Gemini panel and inherit its privileges, reaching the camera, microphone, screenshots and local files. Google patched it, so a current Chrome is not exposed to that specific issue, but it demonstrated the pattern: wiring an assistant into the browser creates privilege paths that did not exist before.

The strongest signal is one that got almost no coverage at all. The Defense Information Systems Agency, which publishes the hardening baselines that US federal systems are measured against, added this to its Chrome security guidance. Its May 2026 release lists finding V-275782, flagging the GenAILocalFoundationalModelSettings policy as a medium-severity finding when the policy is missing or set to allowed. In plain terms, a federal security baseline treats leaving the local model enabled as something to write up.

That is a long way from spyware, and a long way from nothing. It is a new component with a new attack surface, and serious security bodies are treating it that way. This is the same category of problem we covered in malicious AI models and the risk behind the AI tools you use, and the same lesson as the OpenAI models that breached Hugging Face: the AI component is where the new exposure lives.

How to Find and Remove weights.bin

You can delete weights.bin safely. Nothing breaks except the on-device AI features themselves. Finding it takes about ten seconds.

Where weights.bin Lives on Mac, Windows and Linux

On macOS, open your user Library folder, then Application Support, Google, Chrome, and look for a folder named OptGuideOnDeviceModel containing a version-numbered subfolder. On Windows, the same OptGuideOnDeviceModel folder sits inside the Chrome User Data directory under AppData Local. On Linux, look under .config and google-chrome for the same folder. You may also find a smaller OptGuideOnDeviceClassifierModel folder alongside it.

Deleting It Alone Will Not Keep It Gone

This is where most guides stop, and it is why people find the file back a week later. Delete the folder and Chrome will simply download weights.bin again the next time an on-device AI feature is triggered. Reclaiming the disk space only lasts if you also turn off the thing that requests it.

Sources disagree on how much control you get as an ordinary user. Google has said the model can be disabled and removed through Chrome’s settings, while independent write-ups reported no such toggle and treated enterprise policy as the only durable route. Check your own Chrome settings first, since this has moved over time, and treat the policy route below as the reliable answer if you cannot find the control.

The Durable Fix for Managed Machines

On managed devices, the setting is GenAILocalFoundationalModelSettings, applied through Group Policy or your MDM. On Windows it lives under the Google Chrome policies key in the registry, where the default of zero allows the model and a value of one disables it. Microsoft Edge uses the same policy name under its own key, because Edge ships comparable on-device AI. This is the approach the federal baseline expects, and the only one that survives a browser restart.

What Small Businesses Should Actually Do

Do not panic-delete weights.bin across your office. It is not an infection, and treating it as one wastes an afternoon you will spend again next week when it returns.

Do make a decision about it deliberately. If you work in a regulated field, handle client records, or have any obligation to know what processes data on your machines, an undocumented AI component that arrived without consent belongs on your list, and you should disable it by policy rather than by dragging a folder to the trash. If you are a two-person shop running general work, leaving it enabled is a reasonable choice, since the scam and phishing detection it powers has real value.

The broader habit matters more than this one file. Browsers, phones and productivity apps are all quietly gaining local AI components, and most of them will arrive the same way this one did, with no prompt and no announcement. Knowing what is running on your machines is becoming part of basic operational hygiene rather than an IT specialty.

Frequently Asked Questions About weights.bin

What is weights.bin in Chrome?

It is Gemini Nano, Google’s on-device AI model, stored as a single large file inside your Chrome profile folder. Chrome uses it to run features like scam and phishing detection, writing help and summarization locally on your machine instead of sending that work to a server.

Can I delete weights.bin?

Yes, and nothing breaks. The on-device AI features simply stop working. The catch is that deleting the file alone is not durable, because Chrome re-downloads it the next time something triggers an on-device AI feature. To keep it gone you need to disable the feature itself.

Is weights.bin a virus or spyware?

No. There is no evidence it is malicious or that it transmits data. Google states that no data is sent to Google or any third party when the model runs. The genuine complaints are about consent, disk space and bandwidth, not about the file stealing anything.

Where is weights.bin located on Mac and Windows?

On macOS it sits under Library, Application Support, Google, Chrome, in an OptGuideOnDeviceModel folder with a version number. On Windows it is in the Chrome User Data folder under AppData Local. On Linux it is under .config, google-chrome, in the same OptGuideOnDeviceModel folder.

Why did Chrome download weights.bin without asking?

Chrome downloads it automatically once your device clears its hardware checks and you touch a feature that uses the on-device AI APIs. There is no consent dialog and no notification. That silent behavior, rather than the file itself, is what drove most of the criticism.

Know What Is Running on Your Business Machines

Silent AI components are going to keep arriving, and the businesses that get caught out are the ones that never audited what changed. If you want a clear picture of the tools touching your business data and your website, our SEO and analytics work starts with exactly that kind of audit. If an unexplained file or a compliance question has you unsure where you stand, get in touch with Demur Design. For plain-English breakdowns like this one as they publish, subscribe to the Demur Design newsletter in the footer below.

This article is researched and drafted with AI, then reviewed, fact-checked, and published by Demur Design.