Google moved Gemini Computer Use to general availability (GA) on October 30, 2026. The tool, which lets Gemini models “see” a screen via screenshots and derive mouse clicks, keyboard input or navigation steps from it, is no longer labeled as a preview. According to the Gemini API release notes, it is available in both the Interactions API and the GenerateContent API. For developers building browser, Android or desktop agents, what changes is mainly the status – the actual work stays on their side.
That is because Computer Use does not execute anything itself. The model proposes actions; your application carries them out. Anyone who wants to use the tool in production therefore has to build the execution environment, the safety prompts and the logging on their own.
What Gemini Computer Use is and how it works
The official documentation describes a loop of four steps:
- Send a request: The application sends the user’s task, the tool configuration (such as the target environment) and a screenshot of the current screen to the model.
- Read the response: The model returns a
function_callwith a UI action, such as a click, a scroll or a keystroke. For Gemini 4 and Gemini 3.x models, the response also contains anintentfield explaining the reasoning behind the step. Asafety_decisionmay be included as well. - Execute the action: Your code converts the coordinates and performs the action – in Google’s examples, with Playwright in a browser. Coordinates are on a normalized grid from 0 to 999 and must be scaled to the actual screen size.
- Return the new state: After the action, the application sends back a new screenshot plus the current URL as a
function_result, and the model decides on the next step.
This repeats until the task is complete or terminated. You do not need to specify a display size in the request. For Python, Google requires the google-genai SDK version 2.7.0 or higher.
Three environments, different actions
Gemini 4 and the Gemini 3.x models support three environments, selected via the tool’s environment parameter:
- Browser: 20 predefined actions, including several click types, typing, drag and drop, key combinations, scrolling, plus
navigate,go_backandgo_forward. - Mobile (Android-optimized): ten actions, among them
open_app,list_appsandlong_press. - Desktop: OS-level cursor commands, essentially the browser actions without the navigation commands.
Predefined actions can be switched off with excluded_predefined_functions and replaced with custom functions. Google’s example is a yield_to_user function that hands control back to a human, for instance when a two-factor code is required.
Which models support Computer Use
According to the documentation, the tool works with four models:
- Gemini 4 Argon (
gemini-4-argon) – Google’s most capable model, for complex workflows. - Gemini 3.8 Flash (
gemini-3.8-flash) – explicitly named by Google as the recommended model for Computer Use. - Gemini 3.5 Flash-Lite (
gemini-3.5-flash-lite) – the cheaper, low-latency option. - Gemini 3 Flash Preview (
gemini-3-flash-preview) – still listed as a preview model.
On billing, the Gemini API pricing page says Computer Use is not available on the free tier and is charged as regular tokens at the respective model’s price on the paid tier. There is no separate surcharge for the tool itself. Because every turn includes a screenshot, long workflows can still generate a lot of input tokens – worth measuring with real tasks before going to production.
Safety mechanisms: policies, confirmations, prompt injection detection
Safety takes up most of the documentation, and rightly so. Google itself writes that Computer Use “may contain errors and security vulnerabilities” and advises close supervision for important tasks, and avoiding it for critical decisions, sensitive data or actions where serious errors cannot be corrected.
Three layers are built in:
- Safety decisions: An internal system classifies proposed actions as regular, as requiring confirmation (
require_confirmation) or as blocked. When confirmation is required, the application must ask the user and report consent back withsafety_acknowledgement. - Policy categories: Seven categories govern when confirmation is needed – financial transactions, modification of sensitive data, communication such as emails or chat messages, account creation, general data modification, cookie and consent dialogs, and accepting terms of service. Individual categories can be relaxed via
disabled_safety_policies. Google notes, however, that the model may still require confirmation and that applications must always handle that case. - Prompt injection detection: From Gemini 3.5 Flash-Lite onward, the tool can scan screenshots for hidden instructions such as “Ignore previous commands” and block execution. This feature is opt-in and off by default; it is enabled with
enable_prompt_injection_detection.
That last point matters in practice. An agent that reads third-party websites will inevitably see content attackers can control. Because detection is not on by default, anyone who does not explicitly enable it gives up that layer of protection.
What developers should consider before deploying
Google’s own best practices read like a checklist for any computer use agent, regardless of vendor:
- Sandbox: Run the agent in an isolated VM, a container or at least a restricted browser profile. Google points to a Docker-based reference implementation.
- Human in the loop: Do not auto-approve confirmation requests, and define your own rules via system instructions, for example before submitting forms or sending messages.
- Allowlists: Limit permitted destinations; Google says an allowlist is more secure than a blocklist.
- Logging: Record prompts, screenshots, proposed actions, safety decisions and the actions actually executed.
- Clean environment: Start each task from a known state where possible, because unexpected pop-ups can confuse the model.
The list makes clear where responsibility lies. The model supplies suggestions and risk signals; whether a click on “Buy” or “Send” actually happens is decided by the developer’s code.
Analysis
Computer Use has come a long way at Google. According to the release notes, a preview launched with Gemini 2.5 in October 2025, Gemini 3 preview models followed in January 2026, and in June 2026 came the Gemini 3.5 Flash preview with the features documented today, such as intents, three environments, safety policies and prompt injection detection. The GA release is therefore more of a milestone than a major jump in features.
The market for such agents is crowded by now. OpenAI offers GPT-6.1 Terra, its own model for computer tasks, and GitHub Copilot now controls the desktop as well. Google’s announcement offers no solid cross-vendor comparison; the documentation cites no benchmarks or success rates of its own.
For teams that held back because of the preview label, GA signals that Google considers the interface stable. It does not change the fundamental risks: an agent that reads screens and triggers clicks remains vulnerable to manipulated content and misinterpretation. Anyone deploying Gemini Computer Use should turn on prompt injection detection, take confirmation requests seriously and start small – in a sandbox, with clearly scoped tasks.
