Gemini 3.5 Flash makes computer use a built-in tool rather than a separate specialist model. Announced on June 24, 2026, the capability lets developers build agents that interpret screenshots and propose actions across browser, desktop, and mobile environments. The base Gemini 3.5 Flash model is stable and generally available; Computer Use itself is still documented as preview.

That status distinction is essential. A production-ready language model can expose an experimental tool. Developers should not infer that every workflow involving clicks, credentials, or irreversible actions is ready for unattended deployment.

How the computer-use loop works

Computer use resembles function calling with a visual environment in the loop. The application sends a user goal, target environment, current screenshot or observation, and the Computer Use tool configuration. Gemini returns a structured UI action. The developer’s environment executes it, captures the updated interface, and sends that result back for the next decision.

This continues until the model reports completion, encounters a stop condition, or requests confirmation. The model does not bypass the host application and take arbitrary control by itself. The host owns execution, which means it can validate, reject, log, or modify the allowed action set.

Gemini 3.5 Flash adds an intent field to actions. The field explains the purpose of a step, helping a policy layer decide whether a click matches the user’s goal. Intent is useful evidence, not proof. An agent can describe a benign purpose and still target the wrong control.

The three environment types expand use cases:

Google’s documentation and reference implementation should be used for the current action schema. Hard-coding assumptions from an earlier Gemini computer-use preview can break when action types or policy settings evolve.

What Gemini 3.5 Flash contributes

The model supports a 1,048,576-token input context and up to 65,536 output tokens, with text, image, video, audio, and PDF input and text output. It supports code execution, function calling, search grounding, file search, structured output, caching, and other tools. Computer use is one tool within this broader agentic model.

Long context can hold application instructions, policy, task history, and visual evidence, but a UI agent still needs concise state. Repeated full-resolution screenshots and long histories increase token use. Crop or compress observations carefully without hiding the controls the model must inspect.

The integrated model may reduce routing overhead compared with calling one model for reasoning and a separate one for UI actions. It can connect a visual observation to a longer plan. Whether that improves a particular workflow must be measured; integrated does not mean deterministic.

Safety features and their boundaries

Google says Gemini 3.5 Flash received targeted adversarial training for computer-use prompt injection. The company also describes optional enterprise safeguard systems that can require explicit confirmation for sensitive or irreversible actions and stop a task when indirect prompt injection is detected.

This is a defense-in-depth story, not a solved problem. A webpage can contain text telling the agent to ignore its task, upload data, or reveal a secret. A desktop file name or document can do the same. Visual styling may disguise an instruction as part of a trusted interface.

The model’s documentation recommends close supervision and warns against preview use for critical decisions, sensitive data, or actions whose serious errors cannot be corrected. Developers should add:

Treat content retrieved through the UI as untrusted. It can inform the task but must not grant new authority.

Reliability is harder than a benchmark score

Google reports stronger computer-use performance for Gemini 3.5 Flash, but benchmark success does not predict every internal application. Real interfaces contain animations, stale sessions, pop-ups, A/B tests, accessibility gaps, and regional variants. A single pixel shift may change the target.

Test on a controlled set of representative flows. Record completion rate, wrong-action rate, confirmation frequency, elapsed time, screenshots consumed, tokens, and human recovery time. Include adversarial cases: a fake login prompt, an indirect instruction in a document, two similar buttons, an expired session, and a destructive control beside the intended one.

UI automation also needs state verification. After clicking “save,” check for the expected record or confirmation, not merely a changed screen. Before typing a secret, confirm the application identity and destination field. After downloading a file, verify its name, type, hash, and source.

Accessibility metadata can complement pixels when the execution environment exposes it, but it is not automatically authoritative. Labels may be missing, duplicated, or stale. Test both visual and semantic observations, and make sure the agent cannot use hidden interface elements to bypass the controls a person would see. Robustness comes from corroborating state, not from trusting one representation of the screen.

Costs and suitable use cases

Gemini 3.5 Flash is designed for faster, lower-cost agent loops than a frontier Pro-class model, but Computer Use can still consume substantial tokens through repeated screenshots and turns. Google offers different consumption modes for the base model, and current prices belong on the official pricing page rather than in a static workflow assumption.

Total cost includes model tokens, execution infrastructure, browser or device services, retries, human review, and any paid action performed through the interface. A short API call is often cheaper and more reliable than ten visual steps. Computer use earns its place where an API is missing, incomplete, or cannot reach a necessary legacy interface.

Good candidates include testing a web application, performing a reversible back-office workflow, gathering information from an authorized interface, or operating a tool that has no programmable surface. Poor candidates include wire transfers, clinical decisions, broad access to personal accounts, unattended public publishing, and anything where one wrong click creates severe harm.

Prefer direct tools when they exist

Computer use is attractive because it can reach almost any interface, but universality has a cost. A direct function or MCP tool has a typed schema, narrower permissions, and a structured result. It avoids visual ambiguity and is easier to test.

A mature agent can route each action: use an API or MCP tool for supported operations, use computer control only for the gap, and return to structured tools afterward. The UI agent should not scrape a result that a task-status endpoint already provides.

Relating computer use to a Medux workflow

Suppose a team generates or selects source footage in a desktop application, then needs deterministic finishing. A Gemini computer-use agent could help organize the files or operate an authorized legacy interface. For a supported media operation, however, Codex or Claude can call Medux through a separately configured MCP connection with explicit files, parameters, and task IDs.

The Codex MCP video-editing tutorial demonstrates the structured alternative: inspect local files, obtain an approved upload location, create a media task, poll status, and download the result. Medux is not built into Gemini, and the tutorial does not claim a Gemini integration.

A hybrid design might let computer use export a clip from a desktop editor, verify the file locally, and stop. A human then approves the clip for a direct Medux operation. Credentials remain separated, the upload is explicit, and the resulting task ID is stored outside the GUI transcript.

That division captures the real promise of Gemini 3.5 Flash Computer Use. It can bridge interfaces that lack modern automation, while typed tools handle operations that demand reliability. The safest agent is not the one that clicks everything; it is the one that knows when not to click.