Google’s Gemini 3.5 Flash Now Sees and Controls Screens for Enterprises

Google has integrated computer use as a native tool within Gemini 3.5 Flash, the model introduced at I/O 2026 as its fastest agentic AI offering. This update replaces the previous standalone Gemini 2.5 computer use model, allowing AI agents to see screens, click, type, and scroll across browsers, mobile devices, and desktops directly through the Gemini API and the Gemini Enterprise Agent Platform,formerly known as Vertex AI.

Developers no longer need to call a separate dedicated model for building agents that interact with graphical interfaces. Instead, computer use is now one of several tools within Flash, alongside code execution, search, and function calling. Product manager Mateo Quiros explained that this integration gives Flash the capacity to see, reason about, and take action on screens.

Google first launched a standalone computer use model in October 2025, specifically for browser-based agent workflows. That model achieved roughly 70 percent accuracy on the Online-Mind2Web benchmark, relying on a screenshot-action loop where developers fed it a screen capture, received a structured command, executed it, and returned the updated view. Merging this capability into Flash consolidates what was previously a two-model workflow into a single, streamlined process.

The enterprise value proposition centers on automation that extends beyond chatbots. Google highlights use cases like continuous software testing, where agents navigate applications and verify functionality without human testers manually stepping through each screen. Knowledge workers could also deploy agents for multi-step browser tasks, form filling, data extraction from dashboards, or navigating internal tools.

Safety is where Google draws the firmest lines. The company applied targeted adversarial training specifically for prompt injection, an attack where malicious instructions embedded in a webpage or document trick an AI agent into performing unintended actions. This threat is not hypothetical, as researchers have repeatedly shown that AI agents can be manipulated through content they encounter during task execution.

Two optional enterprise safeguards come on top of the base model. The first requires explicit user confirmation before the agent executes any action flagged as sensitive or irreversible, such as submitting a form, making a purchase, or deleting data. The second automatically halts the agent if it detects an indirect prompt injection attempt, stopping execution rather than risking a compromised action.

Both safeguards are opt-in, not defaults. Google recommends a “defense-in-depth” approach, where developers layer multiple protections rather than relying on any single mechanism. The company’s documentation acknowledges that no individual safeguard is sufficient on its own, a candid admission that contrasts with the more confident marketing language surrounding other AI capabilities.

The competitive landscape has shifted since Anthropic pioneered the category. Anthropic’s Claude Computer Use works across operating systems and interacts with file systems, not just browsers, making it more versatile for desktop workflows. Google’s own Chrome Enterprise already added agentic browsing features earlier this year, including Auto Browse for autonomous multi-step tasks.

The new Flash integration extends that philosophy beyond Chrome to any screen an agent can see. OpenAI has also entered the space, and the three companies now compete on different axes. For enterprise buyers, the question is less about which model can click a button and more about which one can do it safely inside a regulated environment.

Google has not published updated benchmark scores for computer use as a built-in Flash tool versus the previous standalone model. The company has not disclosed how many enterprises are using the capability or provided case studies with named customers. The claims about targeted adversarial training for prompt injection are described in the blog post but not backed by published research or red-team results.

The Gemini Enterprise Agent Platform, where the tool is available, uses pay-as-you-go pricing. Flash is one of the cheaper models in Google’s lineup, which could make computer use more accessible for large-scale automation than running it through a heavier model. Whether the cost advantage holds depends on how many actions a typical agent workflow requires and how often the safety guardrails interrupt execution to request confirmation.

Computer use in AI is still early. The models can navigate familiar interfaces but struggle with unexpected pop-ups, CAPTCHAs, dynamically loaded content, and layouts they have not seen before. Google’s decision to make it a built-in tool rather than a standalone model signals confidence that the capability is mature enough for general availability, but the opt-in safety guardrails signal equal awareness that it is not yet mature enough to run unsupervised.