Computer use shipped as a tool, not a model — and that's the right call

On June 24, 2026 Google made computer use a built-in tool inside Gemini 3.5 Flash — letting an agent "see, reason and take action across browser, mobile and desktop environments." Until now this lived in a separate Gemini 2.5 model; folding it into Flash makes it a capability you call, not a model you switch to. It ships via the Gemini API and the Enterprise Agent Platform, with two optional safeguards: user confirmation before sensitive actions, and automatic task-stopping when prompt injection is detected.

Photo by Markus Spiske on Unsplash.

What I take from it

The headline everyone runs is "agent controls your computer." The part I care about is where they put it: a tool on a fast, cheap model, with the safety controls shipped alongside it instead of left as an exercise for the integrator.

What this changes in how I'd build:

• Capability-as-tool beats model-switching. When "drive a browser" is a tool call on the model I'm already using, the agent's planning and its actions share one context. No handoff to a specialist model, no glue to keep state in sync.
• The injection-stopping safeguard is the feature. An agent that can click is an agent that can be told to click — by a malicious page. A model that halts on detected prompt injection is treating the open web as hostile input, which is the only correct assumption. I'd still sandbox it, but built-in defense beats none.
• "Confirm before sensitive actions" is a product decision in disguise. Where you draw the line between autonomous and confirm-first is the UX. That's not Google's call to make for me; it's the knob they correctly left exposed.

Putting computer use on Flash specifically — the cheap, fast tier — signals the intent: this is meant to run in loops, often, not as a premium party trick. That's the bet I'd make too. The risk surface is real, but the packaging is honest about it.

Sources: Introducing computer use in Gemini 3.5 Flash (Google).