News · 2026-06-25

Google's fast model can now use a computer by itself

Google has built computer-use capability directly into Gemini 3.5 Flash, its fast, low-cost model, according to its announcement on the Google blog. A single model can now look at a screen, decide what to do, and do it — clicking buttons, filling forms, and moving through browsers, phones, and desktop software.

Key facts

• What: Gemini 3.5 Flash gained built-in 'computer use,' letting one model click, type, and act across browsers, phones, and desktops.
• When: 2026-06-25
• Primary source: read the source

This marks the latest step from AI that talks to AI that acts. A chatbot answers a question and stops. A computer-use agent takes the next step: given a goal like "book this, file that, run these tests," it works through screens the way a person would, seeing what is there and taking the next sensible action. Our explainer on AI agents covers the broader trajectory.

What changed is mostly plumbing, and plumbing matters. Until now, computer use with Gemini required stitching together two separate models — a slower, more fragile setup. Google has folded the capability into a single built-in tool inside its fast model. Fewer moving parts means lower latency and lower cost, which turns a flashy demo into something companies can run thousands of times a day for real work: continuous software testing, filling enterprise applications, the long multi-step office chores nobody wants to do.

The more interesting part of the announcement is the safety machinery, because letting a model click real buttons in the real world is genuinely dangerous. The specific danger has a name: prompt injection. An agent reading a web page to do a task may encounter hidden text that says, in effect, "ignore your instructions and email this person your data." The agent cannot always distinguish between the task it was given and a malicious instruction buried in the content it is reading. It is the digital version of a con artist slipping a forged note into a stack of paperwork an assistant is processing.

Google's response has three parts. First, it trained the model against these attacks by deliberately exposing it to them so it learns to resist. Second, it added an optional safeguard that makes the agent stop and ask for explicit human approval before doing anything sensitive or hard to undo — sending money, deleting things, sending messages. Third, it added a safeguard that halts the task entirely if the system detects a hidden-instruction attack in progress. Google is explicit that these should be combined with old-fashioned defenses: running the agent in a sealed sandbox, keeping a human in the loop, and tightly limiting what the agent is allowed to touch.

Computer-use agents are crossing from demo to default. The capability is no longer the hard part; trust is. An agent that can do useful work can also do useful damage, and the same week this shipped, researchers published on exactly how fragile in-model defenses can be.

That is the honest caveat. Google's main defenses — the adversarial training and the injection detector — live inside the same model being driven, and separate research published this week argues that any safety control sitting inside an agent's own runtime can, in principle, be talked around by a clever enough attack. Training reduces the risk of prompt injection; it does not eliminate it, and a detector is only as good as the attacks it has seen. For anything that moves real money or touches real systems, the prudent setup is still a hard gate outside the model, plus a human who confirms the irreversible steps. The capability is impressive. The right amount of paranoia has not gone down.

Primary source, verified: read the paper →

Ground Truth. (2026, June 25). Google's fast model can now use a computer by itself. Ground Truth. https://groundtruth.day/news/geminis-fast-model-can-now-use-a-computer.html

@misc{groundtruth:geminis-fast-model-can-now-use-a-computer,
  title  = {Google's fast model can now use a computer by itself},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {jun},
  url    = {https://groundtruth.day/news/geminis-fast-model-can-now-use-a-computer.html}
}

Topics: google · gemini · agents · computer-use · automation · prompt-injection