Summary: On June 24, 2026, Google DeepMind made computer use a built-in tool in Gemini 3.5 Flash, letting one model mix screen actions with function calling and Search or Maps grounding. The model scored 78.4 on OSWorld, level with Claude Sonnet 4.6 and behind Anthropic Opus 4.8 at 83.4. Google offers adversarial training plus optional confirmation and injection-stop safeguards, but provides no independent verification.
Computer use has a new home. On June 24, 2026, Google DeepMind announced the capability now sits inside Gemini 3.5 Flash as a built-in tool — until recently it existed only as the standalone Gemini 2.5 computer use model. Within the mainline Flash model it takes its place beside function calling, Search grounding, and Maps grounding, and because everything lives in one model, developers can mix these tools to build agents that “see, reason and take action across browser, mobile and desktop environments.”
Product manager Mateo Quiros wrote the announcement post. Google frames the capability around long-horizon and enterprise automation work — continuous software testing, and knowledge work that cuts across professional applications. Two demos were shown: the model reading through the Gemini app and returning a categorized feature list, and reviewing Google’s own documentation for accessibility issues.
The Capability Moved In-House
What actually changed is less the capability than its address. Computer use used to be a detour: you called a dedicated older model, then wired its output back into the main workflow. Gemini 3.5 Flash now drives graphical interfaces itself, so an agent settles within one reasoning pass whether the next move is an API call, a web search, or a click on the screen.
Agent architectures come out structurally simpler. Computer use earns its keep exactly where no API exists — legacy systems and desktop software — and bundling it into a Flash-tier model fills the final stretch of interface automation inside Google’s agent toolchain.
Getting access takes no waiting: the Gemini API and the Gemini Enterprise Agent Platform both serve developers and enterprises, and a hosted interactive demo environment plus a reference implementation on GitHub are ready to grab.
The OSWorld Scoreboard: Reading 78.4
Per The Decoder’s coverage, Gemini 3.5 Flash posts 78.4 on the OSWorld benchmark. That lands ahead of Gemini 3 Flash (65.1), GPT-5.4 mini (72.1), and Gemini 3.1 Pro (76.2); level with Anthropic’s Claude Sonnet 4.6 at 78.4; one step behind GPT-5.5 at 78.7. Anthropic’s Opus 4.8 holds the top spot at 83.4.
Laid side by side, the numbers tell one story: computer use has reached the stage where the leading group trades blows within margin-of-error distances and nobody has opened a runaway gap. Google describes the result as its “best performance yet for agentic computer use tasks,” while offering no independent third-party verification.
Keeping Agents in Line: Adversarial Training and Enterprise Controls
An agent with its hands on real interfaces faces the field’s sharpest risk, prompt injection: instructions planted in a hostile webpage or document can hijack the agent into unintended behavior. Google’s opening defense is targeted adversarial training, which lowers the odds that live-environment injection attacks mislead the model.
Behind it stand two optional enterprise safeguards. One requires explicit user confirmation before any sensitive or irreversible action; the other stops a task automatically once an indirect prompt injection is detected. On top of both, Google advises defense in depth — secure sandboxing, human-in-the-loop verification, and strict access controls, taken together.
How Agent Developers Should Read This
Three effects land immediately. The model-selection math changes: a Flash-tier model matching frontier models on OSWorld makes “do I still pay frontier prices for computer use” a question worth recalculating. Safe defaults turn into a differentiator: confirmation flows and injection halts ship as checkbox options, pulling the security clauses enterprise buyers care about down into the platform layer. And computer use crosses over from showpiece to daily engineering, with document review, accessibility checks, and continuous testing — dull but high-value processes — as its first destinations. Prompt injection risk remains yours to assess; sandboxing and human oversight stay non-negotiable.