← Back to feed

Google on Wednesday moved computer use from a standalone experimental model into Gemini 3.5 Flash as a built-in tool. The capability was previously shipped as a separate Gemini 2.5 computer use model; it now ships as an integrated capability in the main Flash model, accessible through the Gemini API and the Gemini Enterprise Agent Platform.

The change is architectural, not just cosmetic. A model with built-in computer use can combine it with other native tools — Search grounding, Maps grounding, function calling — in a single agent loop, without routing between separate models or managing two API sessions. That simplification matters for production deployments where latency and context continuity compound across multi-step tasks.

What It Can Do

Gemini 3.5 Flash with computer use can see, reason about, and take action across browser, desktop, and mobile environments. The stated use cases from Google’s launch are continuous software testing and knowledge work across professional applications — tasks that require sustained context across many steps and across application boundaries.

A demo Google included in the announcement shows 3.5 Flash using computer use to audit the Gemini app’s own documentation for accessibility issues, and separately, to analyse the Gemini app and return a categorised list of features. Both are the kind of self-referential quality assurance tasks that enterprise automation buyers want before trusting agents in production environments.

Safety Architecture

Integrating computer use into a general-purpose model raises injection risk: a model actively taking actions on a live computer can be redirected by malicious content it encounters while browsing. Google’s mitigation approach has three components.

First, targeted adversarial training specifically for the computer use capability, designed to make the model resistant to instructions embedded in web pages, form fields, or documents it encounters mid-task.

Second, two optional enterprise safeguards that builders can enable:

• Explicit confirmation gates: require user approval before the agent executes sensitive or irreversible actions.
• Injection detection stops: automatically halt the task if an indirect prompt injection is identified.

Google is recommending a “defense-in-depth” approach — combining these tools with secure sandboxing, human-in-the-loop verification, and strict access controls. The safeguards are opt-in, not mandatory, which means enterprise deployments set their own risk tolerance.

Developer Access

The capability is live today through the Gemini API with a reference implementation on GitHub. Browserbase is hosting a public demo environment. Enterprise buyers can access it through the Gemini Enterprise Agent Platform in Google Cloud.

Google positions Gemini 3.5 Flash as the cost-efficiency tier of its model lineup — lower latency and lower per-token cost than the Pro models. Making computer use a Flash capability rather than a Pro feature signals that Google sees agentic automation as a volume workload, not a premium feature. Anthropic has charged separately for computer use access via Claude; Google is making it part of the baseline Flash model.

Anthropic’s Claude Opus 4.8 currently holds the highest reported score on Online-Mind2Web at 84%. No benchmark number was included in Google’s Gemini 3.5 Flash computer use launch materials, so a direct comparison point remains pending.