Gemini 3.5 Flash Adds Native Computer Use to Build Agents

Google DeepMind has integrated "computer use" — the direct control of software interfaces — as a native tool within Gemini 3.5 Flash. Until now this capability existed as a standalone model, Gemini 2.5 computer use, but it now becomes part of the main model in the Flash family. The stated goal: to let developers build agents capable of seeing, reasoning and acting across browser, mobile and desktop environments.

What it means for a model to "use a computer"

The term "computer use" describes an AI model's ability to operate applications the way a person would: interpreting what appears on screen, deciding where to click and executing actions within a graphical interface. Rather than simply returning text, the model interacts directly with the software.

This sets it apart from other functions Gemini already handled well. As Google DeepMind explains, the model already excels at function calling — the ability to invoke external functions or services in a structured way — and at using built-in tools like grounding in Search and Maps, which lets it base its responses on data from those services. Computer use goes a step further: it doesn't just consult a source, it manipulates an application.

The announcement, signed by Mateo Quiros, Product Manager at Google DeepMind, frames this integration as delivering the company's "best performance yet" for agentic computer use tasks.

What it's for: automating long tasks

The concrete promise lies in "long-horizon" tasks — processes with many chained steps that until now required constant human supervision. Google DeepMind cites two examples of enterprise application:

• Continuous software testing: an agent that tests applications repeatedly and automatically.
• Knowledge work across professional applications, meaning administrative and office tasks that involve navigating between different programs.

The source illustrates the capability with two cases: the model analyzes the Gemini app itself and returns a categorized list of its features, and it also audits its own documentation for accessibility issues. These demonstrations show the model inspecting and classifying what appears on screen, not merely describing it.

Availability comes through two channels: the Gemini API and the Gemini Enterprise Agent Platform, the company's enterprise-focused agent platform.

The security problem no one can ignore

When a model stops writing text and starts clicking buttons in real environments, the nature of the risk changes. An agent acting on its own can execute irreversible actions, and that is precisely where Google DeepMind places its security focus.

The main risk the company cites is prompt injection: the technique by which a third party embeds malicious instructions — for example, in the content of a web page — so that the agent obeys them instead of following the user's legitimate instructions. In a chatbot this produces problematic responses; in an agent controlling software, it can translate into harmful actions.

To mitigate this, Google DeepMind describes several layers of defense:

• Targeted adversarial training specific to computer use in Gemini 3.5 Flash, aimed at reducing vulnerability to these attacks.
• Two optional enterprise safeguard systems: one that requires explicit user confirmation for sensitive or irreversible actions, and another that automatically stops a task if it detects an indirect prompt injection.

The company frames all of this within a "defense-in-depth" strategy, a security approach that doesn't rely on a single barrier but layers several together. It recommends developers combine these features with secure sandboxing — running the agent in an isolated environment so its actions don't affect the real system —, human-in-the-loop verification, and strict access controls.

The fact that Google insists on human oversight and isolation says something meaningful about the real state of this technology: agentic automation still needs safety nets. Offering an agent that "acts on its own" while simultaneously recommending that a person keep verifying its sensitive actions reveals the tension running through the entire industry: the usefulness of these systems grows the more autonomous they become, but so does the room for a failure to spread unchecked.

How to get started and what it implies

Google DeepMind offers two entry points for developers: testing the capabilities in a demo environment hosted by Browserbase, and starting development from a reference implementation and documentation available through the Gemini API and the Gemini Enterprise Agent Platform.

The source states that customers are already deriving value from this feature, though it does not detail specific verifiable cases beyond generic mentions.

The integration of computer use into the main model of the Flash family — rather than a separate model — is the signal worth paying attention to. By no longer being a standalone piece, the ability to operate interfaces becomes something any developer with access to the model can leverage without switching tools. That reduces friction for building agents, but it also widens the surface on which prompt-injection risks can materialize.

The logical next step will depend on two factors that Google's own communication leaves open: the model's reliability on long tasks outside of controlled demonstrations, and whether enterprise safeguards are enough for companies to trust delegating real actions to an agent. For now, the bet is on the table; the verdict will come from the automations that survive contact with real production environments.