Introducing computer use in Gemini 3.5 Flash

Google DeepMind quietly folded a big capability into its mainstream model this week: Gemini 3.5 Flash can now see a screen, reason about it, and actually operate it. Buttons, forms, browser tabs, desktop apps — all fair game. Until now, that skill lived in a separate, standalone Gemini 2.5 computer-use model. Bolting it onto the flagship Flash line changes the calculus for anyone building agents, because they no longer need to juggle two models to get an assistant that can both talk and do.

Mateo Quiros, a product manager on the team, framed this as Google's best agentic performance yet, and the pitch makes sense once you consider what Flash already does well. It handles function calling and plugs into tools like Search and Maps grounding without much fuss. Add native computer use, and suddenly you have a single model capable of chaining together long, messy tasks — software regression testing that runs for hours, or knowledge workers automating multi-step chores across Excel, Slack, and whatever legacy enterprise tool refuses to have an API. That's the real target audience here: enterprises with clunky internal software nobody wants to touch.

Of course, letting an AI click around your screen unsupervised is exactly the kind of thing that keeps security teams up at night. Google's answer is a mix of adversarial training baked into 3.5 Flash specifically to blunt prompt injection attacks, plus two optional safeguards enterprises can switch on. One forces explicit human confirmation before the agent does anything irreversible — deleting a file, sending a payment. The other auto-kills a task the moment it detects an indirect prompt injection hiding in a webpage or document. Google is calling this