Our Take
Computer use is now table stakes for LLM platforms, not a differentiated capability—Google's move consolidates what Anthropic proved works, but the safety bet (adversarial training plus optional guards) is where the real product story lives.
Why it matters
Enterprises running continuous testing, document audits, and knowledge work across multiple applications now have a faster, cheaper path to agent automation without managing a separate model. The safety framework signals Google is serious about enterprise adoption, not just demos.
Do this week
Product teams: test Gemini 3.5 Flash's computer use against your current agent stack (Claude or Gemini 2.5) on a single workflow before replatforming, so you can measure latency and cost against your baseline.
Google moved computer use into the base model
Computer use is now a built-in capability in Gemini 3.5 Flash, available via the Gemini API and Gemini Enterprise Agent Platform (as of June 24, 2026). Previously, Google offered computer use only as a standalone Gemini 2.5 model. The move consolidates the feature into the main Flash model, allowing developers to build agents that see, reason, and act across browser, mobile, and desktop environments without switching models.
Google demonstrated the capability on its own products: 3.5 Flash analyzed the Gemini app and returned a categorized feature list, and audited internal documentation for accessibility issues. The company positions this as unlocking long-horizon and enterprise automation tasks like continuous software testing and multi-step knowledge work across professional applications.
Safety approach combines training with optional enterprise controls
Google deployed targeted adversarial training to reduce prompt injection risks for agents operating in live environments. Beyond that, the company is releasing two optional enterprise safeguard systems: explicit user confirmation for sensitive or irreversible actions, and automatic task termination if an indirect prompt injection is detected. Google calls this a defense-in-depth model and recommends developers combine these features with secure sandboxing, human-in-the-loop verification, and strict access controls.
This is the first public statement of Google's approach to agent safety at the platform level. Anthropic published similar safeguards for Claude's computer use months earlier, making this table stakes rather than novel.
Consolidation, not innovation, shapes the market
Computer use in LLMs has moved from research proof-of-concept to expected product feature across major vendors. Google's decision to embed it in the faster, cheaper 3.5 Flash model (rather than keeping it in a separate model) removes friction for developers who need cost efficiency and latency-sensitive deployments.
The real competitive signal is the safety framework. Enterprises will choose between vendors based not on whether computer use exists, but on which platform's safeguards they trust enough to run unattended agents on production systems. Google's adversarial training plus optional confirmation gates gives enterprises a levers-based approach to risk management.
Pricing matters here too. Flash is positioned as Google's fast-and-cheap tier (per prior positioning). Bundling computer use into Flash, rather than reserving it for a premium model, signals a bet on volume adoption over margin-per-agent. That changes the unit economics for startups and enterprises building multi-agent systems.
How to evaluate this for your stack
Computer use benchmarks remain vendor-published, not independently reproduced. Google has not published latency, accuracy, or cost comparisons against Gemini 2.5 (the prior computer use model) or against Claude's computer use. A demo environment is available via Browserbase, but this is a proof-of-concept, not production data.
If you are currently using Gemini 2.5 for computer use, the move to 3.5 Flash likely reduces cost and latency (Flash is faster than prior generations), but test your own workflows before migrating. If you are using Claude's computer use, Gemini 3.5 Flash is now a direct competitor; evaluate on latency, accuracy, and compliance with your data residency requirements.
The enterprise safeguard features (confirmation gates and injection detection) are optional. Audit whether your current agents need them before adoption. If you are running agents on live customer systems, these controls are worth testing, but they add latency and require user interaction—measure the tradeoff against your automation goals.