Gemini 3.5 Flash is now capable of viewing and managing your screen, and Google aims for businesses to place their confidence in it.

      Google has integrated computer use directly into Gemini 3.5 Flash, superseding the previous standalone Gemini 2.5 computer use model with added enterprise safeguards. This feature, which was introduced at I/O 2026 as Google's fastest agentic AI model, allows AI agents to interact with screens, click, type, and scroll across various devices, including browsers and desktops. Previously, this functionality necessitated a distinct model but is now accessible as a native tool via the Gemini API and the renamed Gemini Enterprise Agent Platform, which was formerly known as Vertex AI.

      As a result of this update, developers no longer need to engage a separate computer use model for creating agents that work with graphical interfaces. They can simply activate computer use alongside other functionalities such as code execution, search, and function calling within Flash. Product manager Mateo Quiros emphasized that this integration equips Flash with the capability to observe, reason, and act on screens.

      Initially, Google introduced a separate Gemini computer use model in October 2025, tailored for browser-based workflows. This model achieved approximately 70 percent accuracy on the Online-Mind2Web benchmark and was based on a screenshot-action loop, where developers provided a screen capture, received a structured command, executed it, and sent back the updated view. Merging this capability into Flash streamlines what used to be a two-model process into one.

      The enterprise focus highlights automation that extends beyond conventional chatbots. Google states that this tool facilitates continuous software testing, allowing agents to navigate applications and verify functionality without the need for human testers to go through each screen. Knowledge workers can harness agents to carry out multi-step browser tasks, fill out forms, extract data from dashboards, or navigate internal systems.

      Google places significant emphasis on safety architecture in this update. The company has implemented targeted adversarial training specifically to counter prompt injection attacks, where malicious instructions in a webpage or document can deceive an AI agent into executing unintended actions. This concern is substantiated, as researchers have repeatedly shown that AI agents can be influenced by the content they encounter during task execution.

      Google provides two optional enterprise safeguards in addition to the base model. The first requires explicit user confirmation before the agent performs any action deemed sensitive or irreversible, such as submitting forms, making purchases, or deleting data. The second safeguard automatically halts the agent if it detects a potential attempt at prompt injection, stopping execution to prevent any compromised actions.

      Both safeguards are opt-in rather than default settings. Google advises adopting a “defense-in-depth” strategy, encouraging developers to implement multiple protective measures instead of relying on a single mechanism. The company’s documentation acknowledges that no individual safeguard is sufficient on its own, presenting a candid view that contrasts with the more assertive marketing language regarding other AI features.

      The competitive landscape has changed significantly since Anthropic established the category. Anthropic’s Claude Computer Use operates across operating systems and can interact not only with browsers but also with file systems, enhancing versatility for desktop tasks. Google’s own Chrome Enterprise introduced agentic browsing features earlier this year, including Auto Browse for autonomous multi-step tasks.

      The new Flash integration broadens this principle beyond Chrome to any screen an agent can access. OpenAI has also entered the market, and now the three companies are competing along different lines. For enterprise buyers, the focus has shifted from which model can perform simple actions to which can do so safely within a regulated environment.

      Google has not released updated benchmark scores for computer use as an integrated Flash tool compared to the previous standalone model. The company has also not disclosed how many enterprises utilize this capability or provided case studies featuring named customers. While the blog post discusses targeted adversarial training for prompt injection, it lacks published research or results from red-teaming to validate these claims.

      The Gemini Enterprise Agent Platform, where this tool is offered, operates on a pay-as-you-go pricing model. Flash is among the more economical options in Google's product lineup, potentially making computer use more accessible for large-scale automation compared to operating through a heavier model. Whether this cost advantage remains depends on the number of actions typical agent workflows require and how frequently the safety measures interrupt execution to request confirmation.

      Computer use in AI is still in its early stages. These models can navigate familiar interfaces but often find difficulties with unexpected pop-ups, CAPTCHAs, dynamically loaded content, and unfamiliar layouts. Google's choice to make it a built-in tool instead of a standalone model indicates confidence in the capability’s readiness for broader availability, while the opt-in safety measures reflect an acknowledgment that it may not yet be fully mature for unsupervised operations.