Google has incorporated the computer use feature directly into Gemini 3.5 Flash. The tool allows AI agents to observe interfaces, reason through a task, and perform actions in browsers, mobile devices, and desktop computers.
Until now, this capability was available as a standalone model based on Gemini 2.5. By integrating it into the main Flash version, developers can create more complete agents without having to combine separate models for conversation, tool use, and graphical interface operations.
What Gemini 3.5 Flash can do
Gemini already offered capabilities such as function calling, search, and Google Maps-grounded queries. With computer use, the model can also interact with applications that do not necessarily provide a direct API.
In practice, this makes it possible to automate tasks such as:
- Continuously testing an application from a user’s perspective.
- Navigating enterprise platforms and collecting information.
- Completing workflows in professional applications.
- Running multi-step processes in browsers, mobile devices, and desktops.
- Coordinating actions across different digital tools.
The important difference lies in the duration and complexity of the tasks. An agent does not simply answer a question: it can analyze the state of an interface, decide what to do next, perform an action, and verify the result.
The goal is to move from assistants that generate text to agents capable of working inside the digital environments where people already operate.
Security against instruction injections
Giving an agent access to an interface also introduces risks. A web page, email, or document could contain hidden instructions designed to trick the agent. This type of threat is known as indirect prompt injection.
To reduce that risk, Google says it applied specific adversarial training for computer use tasks in Gemini 3.5 Flash. The goal is for the model to better identify manipulation attempts while operating in real-world environments.
The company also offers two optional protection systems for businesses:
- Require explicit user confirmation before sensitive or irreversible actions.
- Automatically stop the task when a possible indirect instruction injection is detected.
These measures do not replace a complete security architecture. Google recommends combining them with isolated environments, human review, strict access controls, and verification mechanisms before carrying out critical actions.
Why it matters for developers
Native integration can simplify agent design. Instead of building an architecture that separates reasoning, tool use, and interface interaction, teams can work with a Flash model that brings these capabilities together in a single workflow.
This is especially relevant for enterprise automation, software testing, and knowledge work. For example, an agent could review an application, detect unexpected behavior, document it, and escalate it for human review.
Still, access to a computer does not automatically turn an agent into a reliable autonomous worker. Applications can change their design, data can be ambiguous, and a wrong action can have real consequences. That is why limited permissions and supervision remain essential.
How to start testing it
Google says developers can try the feature in a demonstration environment hosted by Browserbase. They can also consult a reference implementation and the corresponding documentation for the Gemini API and Gemini Enterprise Agent Platform.
The launch points to a clear direction for AI agents: it is no longer only about responding from a chat window, but about operating thoughtfully within the tools we use every day. The question now is not whether these systems will be able to do more, but how to design them so they know when to act, when to ask for permission, and when to stop.