Google made the Gemini API Computer Use tool generally available on 30 October 2026, across the Interactions and GenerateContent APIs. Agents can now drive browser, mobile and desktop screens. Before launch, turn on prompt injection detection, which is off by default, handle every confirmation request, and keep each run in a sandbox.
What Google released
Computer Use was announced as generally available by Google on 30 October 2026 in the Gemini API changelog. The tool now works in both the Interactions API and the GenerateContent API, so teams that built on either can keep their existing request shape.
The Computer Use guide lists four models that support it:
- Gemini 4 Argon (
gemini-4-argon), for complex reasoning and agentic UI workflows. - Gemini 3.8 Flash (
gemini-3.8-flash), which Google names as the recommended model for computer use. - Gemini 3.5 Flash-Lite (
gemini-3.5-flash-lite), the low-latency, lower-cost option. - Gemini 3 Flash Preview (
gemini-3-flash-preview), still a preview model.
For production work, choose one of the first three. A preview model can change under you, which is the opposite of what a GA launch is meant to give you.
How the tool works
The model does not touch your machine. Your code runs a loop: send the task and a screenshot, receive a suggested action such as click, type, scroll, drag_and_drop or navigate, execute it with your own automation layer (the guide uses Playwright), capture a new screenshot and send it back. Coordinates arrive on a 0 to 999 grid, and your client scales them to the real screen size.
Each environment, browser, mobile or desktop, has its own action set. On Gemini 4 and Gemini 3.x models, every action also carries an intent field explaining why the model chose it. Log that field: it is the quickest way to see why an agent clicked the wrong button.
On cost, the pricing page says Computer Use is not available on the free tier and is charged as regular tokens at the chosen model's price on the paid tier. Every step sends a fresh screenshot, so a long task with many small steps costs more than a short one with a few decisive steps. Put a step limit on each run and track tokens per completed task, not per request.
The safety settings to check before launch
This is where a prototype and a production agent differ. Four settings decide how much the agent can do without a person.
Built-in safety policies
The guide lists seven policy categories, applied on Gemini 4 and Gemini 3.x models: FINANCIAL_TRANSACTIONS, SENSITIVE_DATA_MODIFICATION, COMMUNICATION_TOOL, ACCOUNT_CREATION, DATA_MODIFICATION, USER_CONSENT_MANAGEMENT and LEGAL_TERMS_AND_AGREEMENTS. They stop the agent paying, sending messages, creating accounts, accepting terms or changing records on its own.
You can switch some of them off with disabled_safety_policies. Our advice: disable a policy only for a named workflow that needs it, such as data_modification for a log-archiving job in a throwaway container, and record who approved it. Never disable policies globally to make a demo run faster.
Confirmation handling
An action can come back with a safety_decision of require_confirmation. Your client must show the explanation to a person and, if they approve, send safety_acknowledgement in the function result. Google is explicit that the model may still ask for confirmation after you have overridden a policy, so the confirmation path has to exist in every deployment, not only the cautious ones. A blocked action should end the run. Our guide to human in the loop without friction covers how to keep those prompts short enough that people read them.
Prompt injection detection
Screens are untrusted input. A web page can carry hidden text telling the agent to ignore its instructions. The tool can scan each screenshot for this and block execution when it finds it, but enable_prompt_injection_detection defaults to false and works on Gemini 3.5 Flash-Lite or later. Turn it on for any agent that visits pages you don't control.
Hand control back on purpose
You can remove predefined actions with an exclusion list and register your own functions. The guide's example replaces click with a custom yield_to_user function in a human-in-the-loop setup. That pattern suits agents that should read and fill forms but leave the final submit to a person.
What to build around it
The guide's safety section reads as a checklist, and we agree with all of it:
- Sandbox every run in a VM, a container or a browser profile with limited permissions. Google's reference implementation includes a Docker setup. Our post on testing agent write actions in a sandbox covers what to check before anything reaches real systems.
- Allowlist where the agent may go. A blocklist is a start; an allowlist of domains or apps is safer.
- Log everything: prompts, screenshots, suggested actions, safety decisions and the actions your client actually executed. That is the record you need when auditing what an AI agent did.
- Start from a clean state. Pop-ups, notifications and layout changes confuse the model, so reset the environment between tasks.
Google's own note still warns against using Computer Use for critical decisions, sensitive data or actions where serious errors cannot be corrected. GA means the API is supported, not that every task is safe to hand over.
When not to use it
If the system you need to drive has an API, call the API. Screen control is slower, costs more per task and breaks when the layout changes. Keep Computer Use for legacy tools, third-party portals and testing user flows, as we set out in should your AI agent use the browser or the API. Teams already running Claude for this can compare the two loops with our notes on Claude browser and computer use; the confirmation and logging work is much the same.
Frequently asked questions
Which models support Gemini Computer Use?
Google's guide lists Gemini 4 Argon, Gemini 3.8 Flash, Gemini 3.5 Flash-Lite and Gemini 3 Flash Preview. Gemini 3.8 Flash is the recommended model for computer use, Gemini 4 Argon suits complex multi-step workflows, and Gemini 3.5 Flash-Lite is the lower-cost, low-latency choice. Gemini 3 Flash Preview is still a preview model, so avoid it for production agents that need stable behaviour.
How much does Gemini Computer Use cost?
The Gemini API pricing page says Computer Use is not available on the free tier. On the paid tier it has no separate fee and is charged as regular tokens at the price of the model you call. Because each step sends a new screenshot, the number of steps drives the bill, so set a step limit per task and measure tokens per completed task.
Is prompt injection detection on by default?
No. The enable_prompt_injection_detection setting defaults to false, so you have to turn it on in the tool configuration. When enabled, it checks each screenshot for hidden adversarial instructions and blocks execution if it finds them. It works with Gemini 3.5 Flash-Lite or later. Enable it for any agent that reads web pages or documents you do not control.
Can I turn off the confirmation prompts?
You can disable selected safety policies with disabled_safety_policies, but Google says the model may still return require_confirmation in some cases. Your client must always handle that decision by asking a person and sending a safety acknowledgement only after they approve. Disable a policy only for a specific, sandboxed workflow that needs it, and keep a record of who approved the change.
