You dropped twenty PDFs into a NotebookLM notebook last month and treated it like a quiet, sealed room: your sources in, answers out, nothing leaving. As of June 8, 2026, that room has a computer in it and a door to the open web. Google shipped its largest NotebookLM update yet, giving every notebook a secure cloud computer that writes and runs code, plus an agentic mode that uses Google Search to find and add new sources on its own.
Most coverage led with speed and the eleven new output formats. The more interesting question is quieter: when a research tool gains the ability to run code and reach the internet for you, where does your context actually live, and who can touch it? The short version is that your sources stay private and Google says it does not train on them, but the trust boundary moved. It now sits inside one Google silo you cannot carry anywhere.
What actually shipped on June 8, 2026
The headline change is a sandboxed cloud computer attached to every notebook. Google describes it as a secure cloud computer that lets NotebookLM write and run code for deeper research and analysis, backed by more than 100 curated software skills. The whole product also moved to Gemini 3.5 running on a new agentic framework Google calls Antigravity, the same infrastructure it unveiled at its May 2026 developer conference. Google says the pairing produces more accurate answers and better visibility into the model's thinking process.
Google did not ship this on vibes. It reported an average win rate above 65 percent across five core evaluation dimensions against the previous version, climbing to 78.2 percent on advanced web research and source discovery and 69.9 percent on large document analysis. Take a vendor's own benchmarks with the usual salt, but the direction is clear: the gains are largest exactly where the new web-reaching agent and code runner do their work.
Two other changes matter for how data moves. First, agentic web research: NotebookLM can now guide you through building a source repository inside the chat, using Google Search to find high quality sources and add them to your notebook, with you retaining control over which ones get added. This flips the old workflow. Before, you arrived with a finished set of files. Now you can start from loose ideas and let the tool assemble the corpus around them. Second, output expanded to eleven downloadable formats generated through the studio panel, including charts and SVGs, PDFs and Word docs, CSV and JSON, Excel spreadsheets, and PowerPoint decks. The cloud computer is what makes those formats possible: generating a real xlsx or pptx means running code, not just printing text.
The rollout is not universal. Google says these features are rolling out globally on the web to users with Google AI Ultra and Workspace business customers with AI Ultra Access and AI Expanded Access. If you are on a free consumer plan, you have the old grounded chat, not the cloud computer.
A notebook used to be a sealed room. After June 8, it is a workshop with a code runner and a search engine wired in.
Why the model swap is not just a version number
The jump to Gemini 3.5 plus Antigravity is paired with the cloud computer for a reason. Google frames the combination as giving better visibility into the model's thinking, and the more than 100 curated software skills are the toolkit that thinking reaches for. In practice that means the model can decide a question needs a calculation, write the code, run it in the sandbox, and hand you a chart instead of a paragraph of estimated numbers. For data-heavy research, generated output you can check beats prose you have to trust.
The point of NotebookLM was source-grounding. That part still holds
NotebookLM was built so the model answers from the sources you upload, not from the open internet, with every claim attributed back to a passage. That design is intact. Google's June announcement reaffirms that you stay in control of the sources you add, your work stays grounded in information you trust, and all sources remain clearly attributed. The grounding is the whole value: it is why people trust a notebook over a raw chatbot for serious research.
The new agentic surface bends that promise without breaking it. When NotebookLM pulls fresh sources from Google Search, your notebook is no longer a closed set of files you personally vetted. It is a set you curated plus a set an agent proposed. You approve each addition, so the control is real, but the mental model of a hand-picked corpus is gone the moment you let the agent shop the web for you. The practical advice is simple: read what the agent adds before you reason over it. A source you did not choose, ranked by a search algorithm, is a source you have not yet checked for bias or accuracy. Approval is a gate, not a guarantee.
Does Google train on your NotebookLM sources? No
On a personal Google account, NotebookLM will not use your content to directly train Google's foundational AI models unless you choose to provide feedback, such as a thumbs up or thumbs down, which then gets reviewed by trained teams to fix problems. On a Workspace account, the bar is higher: your uploads, queries, and the model's responses are not reviewed by human reviewers even when you give feedback, and are not used to train AI models. Sources you upload stay private unless you choose to share the notebook.
Read the personal-account wording closely. The protection is strong by default, but it has a hinge: feedback. Click thumbs up on a generated answer and you opt that exchange, including the prompts, customizations, sources, and outputs, into human review. Google does disconnect that feedback from your account before a reviewer sees it. Even so, it is a boundary worth knowing before you reflexively rate every response in a notebook full of sensitive material.
If a notebook holds confidential or regulated documents, skip the thumbs up and thumbs down on its answers. Feedback is the one default path that routes personal-account content to human review.
The new trust boundaries the cloud computer introduces
A code runner changes the question from who reads my files to what acts on my files. The cloud computer executes code generated by the model against your sources to build charts, parse spreadsheets, and run analysis. Google describes the environment as secure and sandboxed, and there is no evidence of any breach. The honest framing is narrower: you have added a new automated actor that touches your data, and a new web-facing pathway through which sources arrive. More moving parts is more surface, even when every part is well built.
There is a second-order risk that comes free with any agent that reads from the web: prompt injection. If the agent fetches a page that contains hidden instructions, those instructions enter the same context as your trusted sources. Google's grounding and your per-source approval blunt this, but the general lesson stands. The moment a tool reads untrusted web content and runs code, you treat what it brings back as input to verify, not gospel to act on.
None of this means avoid the upgrade. It means update your habits to match the new capability. Three rules cover most of it: vet agent-added sources before reasoning over them, hold back feedback clicks on sensitive notebooks, and remember that anything generated in a notebook is generated inside Google's box, not on your machine. The features are powerful precisely because they do more on your behalf, and doing more on your behalf is exactly when knowing the boundaries pays off.
Where your research context actually lives now
Here is the part the feature list buries. Everything in a notebook, the curated sources, the agent-added ones, the generated analysis, the running thread of your thinking, lives inside that one notebook, inside Google. It is not a memory you can move. Switch to Claude for a writing pass or to ChatGPT for a different angle, and none of that accumulated context comes with you. You rebuild it by hand, in the new tool, every time. The deeper you invest in a notebook, the higher the wall around it grows. A casual notebook is easy to abandon. A notebook with a month of curated sources and generated analysis is a hostage situation.
That is the structural cost of a deeper, more capable notebook. The richer the workspace, the more painful it is that the richness is captive. A better NotebookLM is a better silo, and a silo is still a silo. The same trap exists in every chat tool with built-in memory: ChatGPT remembers things in ChatGPT, Gemini in Gemini, and now NotebookLM in NotebookLM. None of those memories speak to each other. Your research life ends up scattered across four walled gardens, each one slightly out of date with the others.
| Dimension | NotebookLM notebook | Portable memory layer |
|---|---|---|
| Where context lives | Inside one Google notebook | External layer you own, across tools |
| Works across ChatGPT, Claude, Gemini | No, scoped to NotebookLM | Yes, same memory everywhere |
| Agentic web reach | Yes, adds sources with approval | No, it stores your context, not a researcher |
| Trains on your content by default | No, unless you give feedback | No, not used for training |
| Carry it to a new tool tomorrow | Rebuild the notebook by hand | It follows you, no rebuild |
Carry your memory instead of rebuilding the room
NotebookLM's June upgrade is genuinely strong for analyzing a fixed body of sources in one place. What it does not do is travel. The context you build stays locked to one vendor's notebook. MemX is the part NotebookLM leaves out: an external memory layer that holds your facts, preferences, and project context and surfaces them across ChatGPT, Claude, and Gemini, so you stop retyping the same brief into each tool.
It is private by architecture: per-user isolation, encryption at rest, and your data is not used for training. The split is clean. Use NotebookLM for the heavy, source-grounded analysis it now does well. Use MemX for the continuity that should not be trapped inside any single product, including this one. The bet behind a portable memory layer is that your context is yours, and that no vendor, however good its latest upgrade, should be the only place it can exist.
Frequently asked questions
01What did NotebookLM add on June 8, 2026?
Google gave every notebook a secure cloud computer that writes and runs code, agentic web research that finds and adds sources with your approval, eleven downloadable output formats, and an upgrade to Gemini 3.5 on a framework called Antigravity. It rolled out to AI Ultra and select Workspace plans.
02Does NotebookLM train AI models on my uploaded sources?
No. On personal accounts your content is not used to directly train Google's foundational models unless you submit feedback. On Workspace accounts, uploads and responses are not human-reviewed and not used for training. Sources stay private unless you share the notebook.
03Is the NotebookLM cloud computer safe?
Google describes it as a secure, sandboxed environment, and there is no reported breach. The real change is that a new automated actor now runs code against your sources and the agent can pull in web content, so treat agent-added material as input to verify.
04Can I move my NotebookLM context to ChatGPT or Claude?
No. Everything in a notebook, your sources, agent additions, and generated analysis, stays inside that Google notebook. There is no portable memory. To carry context across tools you need an external memory layer that is not scoped to one vendor.
05Who gets the new NotebookLM features?
As of June 2026, the cloud computer and agentic research roll out globally on the web to Google AI Ultra users and Workspace business customers with AI Ultra Access and AI Expanded Access. Free consumer accounts keep the existing grounded chat without these additions.
The takeaway
NotebookLM's June 8 upgrade is a real jump in capability, and the privacy basics hold: sources stay private and Google says it does not train on them by default. The catch is structural, not a scandal. A more powerful notebook is a richer silo, your context now sits beside a code runner and a web-reaching agent, and none of it travels. Use NotebookLM for what it does well, and keep the memory you want to reuse somewhere you actually own.
