Google's changelog of October 30, 2026 says Computer Use is generally available across the Interactions and GenerateContent APIs, and the tool page lists one model as Preview. The docs list seven safety policy categories and opt-in injection detection. The pages we read give no accuracy figures, no Computer Use-specific rate limit and no statement on screenshot handling or regions. It is not available on the Free tier. We tested nothing.
A computer use tool lets an AI model look at a screenshot of a screen and suggest what to click or type. Your own software then does the clicking and sends back a new screenshot, and this repeats until the task ends. Typical uses (our examples, not Google's) are data entry, form filling, testing and research across sites. The Interactions API and GenerateContent, both named in this article, are the two ways a developer can call the model.
The catch: the model reads whatever is on screen, including instructions a page may carry, hidden or visible (called prompt injection), and your software then acts on its suggestions. Google's docs describe safety policies, confirmation steps and an opt-in detector, and they also say the tool may contain errors and security vulnerabilities. This article lists what the pages state and what they leave out.
Basis: public Google documentation read on November 5, 2026 - the Gemini API release notes, the Computer Use page, the pricing page, the Models page, the pages for five models, the Interactions API overview, the logs policy and the API references. We tested nothing, and each number and quote belongs to Google, which published it. Our inference and our recommendations are marked as ours. This is a reading of documents, not a review of how the tool performs.
What did Google release as generally available?
Google's release notes have an entry dated October 30, 2026, titled "Computer Use generally available (GA)". It says Google released the Computer Use tool "to general availability (GA) across the Interactions and GenerateContent APIs". The entry names no model, price, region or limit. Earlier entries show the path: a Gemini 2.5 Computer Use Preview on October 7, 2025; support in gemini-3-pro-preview and gemini-3-flash-preview on January 29, 2026; and a public preview in Gemini 3.5 Flash on June 24, 2026 that added intents, browser, mobile and desktop environments, configurable safety policies and prompt injection detection.
The tool page itself uses neither the word "GA" nor a status badge, and it lists one model as Preview. So the reading is narrow: per the changelog, the tool is generally available across two APIs, and the docs page lists gemini-3-flash-preview as a preview model. The changelog does not say which models the GA covers. All code samples on the tool page use the Interactions API; no page we read mentions a GenerateContent example. Google's API reference for GenerateContent does document the fields computerUse, enablePromptInjectionDetection and disabledSafetyPolicies, and Google's documentation index (llms.txt) says generateContent "is still supported for existing integrations, but is considered a legacy API".
Which models and environments does the tool support?
When we read it on November 5, 2026, the page's "Model versions" section listed four models, in Google's words:
gemini-4-argon: "Our most capable model, supporting computer use for complex reasoning and agentic UI workflows."gemini-3.8-flash: "The recommended model for computer use". Google's description adds "high-accuracy UI interaction and reliable tool calling"; the page gives no figure behind those words.gemini-3.5-flash-lite: "A low-latency, cost-effective model supporting computer use."gemini-3-flash-preview: "Preview model supporting computer use."
On the Models pages, the first three are labelled Stable (latest update October 2026, September 2026 and July 2026) and the last Preview (December 2025). Each shows Computer use as supported. One mismatch: the gemini-3.6-flash model page also shows Computer use as supported, but the tool page does not list that model. The pages are silent on which list is meant to be complete. The June 24 changelog entry mentions "Gemini 3.5 Flash", while the tool page lists 3.5 Flash-Lite.
The page documents three environments, and we counted the actions in its tables: browser 20, mobile 10 and desktop 17. Browser actions include click, type, scroll, drag and drop, hotkey and navigate; mobile adds open_app and long_press. Every action carries an intent field, which the page says "explains the model's reasoning behind each step". Your code does the work: the page says you "need to implement the client-side execution environment", then loop: send a screenshot, receive an action, execute it, send a new screenshot. Screenshots in the samples are PNG images.
On coordinates, the page gives two descriptions that fit together and a third that reads differently. The action tables give x and y as integers from 0 to 999. The execution section says to convert the model's coordinates to your screen size, and its sample code divides by 1000. The request section says the model "predicts pixel coordinates scaled to the height and width of the screen". The page does not say how the pixel wording relates to the 0-999 grid. Our inference: build the conversion once, test it with known screen sizes and do not assume it from the prose.
What safety controls does the API provide?
Start with Google's own caution, a callout at the top of the page: "Computer Use may contain errors and security vulnerabilities." Google recommends supervising closely for important tasks and avoiding the capability for "critical decisions, sensitive data, or actions where serious errors cannot be corrected". The docs on these pages publish no accuracy figures.
The page lists seven built-in safety policy categories, that Google says help determine when confirmation is required:
FINANCIAL_TRANSACTIONS: payments, retail checkout, regulated goods.SENSITIVE_DATA_MODIFICATION: health, financial or government records.COMMUNICATION_TOOL: sending emails, chat messages or drafts.ACCOUNT_CREATION: registering new accounts.DATA_MODIFICATION: file system changes, data sharing, storage deletion.USER_CONSENT_MANAGEMENT: cookie banners and privacy prompts.LEGAL_TERMS_AND_AGREEMENTS: accepting terms or binding contracts.
These are Google's defaults, and you can "override select policies" with the disabled_safety_policies setting. The guide does not say which policies can be overridden; Google's API references list all seven categories as accepted values (lower-case strings in the Interactions API, capitals in the GenerateContent reference, and the guide's examples use lower case while its table uses capitals), and what an override does for each category is not described. Google says that even with overrides the model may still return a safety_decision with require_confirmation in some cases: "Your application should always implement safety decision handling regardless of configured overrides."
A safety_decision classifies an action as allowed, require_confirmation or blocked. For require_confirmation the page tells you to prompt the user and, if they agree, send a safety_acknowledgement. For a blocked action, your client "should halt the execution or handle the interruption". The page's best-practice list also asks for a sandboxed VM, container or "a dedicated browser profile with limited permissions", allowlists or blocklists for navigation, and client-side logs of prompts, screenshots, proposed actions, safety responses and executed actions. Our reading: the confirmation step, the logging and the sandbox are things your team builds; the API supplies the signal. Also our reading: the categories are a signal, not a guarantee that every risky action is flagged, so keep your own hard stops for payments, messages and account changes. The intent field is the model's own explanation of a step, not proof of what the step will do.
Is prompt-injection detection on by default?
No. The page says: "Prompt injection detection is an opt-in feature. The default is false." You switch it on with enable_prompt_injection_detection. The page states it is supported for "Computer Use for Gemini 3.5 Flash-Lite or later". When enabled, it "checks whether an included screenshot contains hidden adversarial instructions (for example, "Ignore previous commands") and blocks execution when detected."
What we did not find on these pages: a detection rate or false-positive figure, whether it applies to gemini-3-flash-preview (our inference from the model pages' latest-update dates is that it predates 3.5 Flash-Lite), and what a blocked run returns beyond the generic "blocked" decision. The same page says input sanitization is "not a replacement for a secure execution environment", so the sandbox advice stands whether or not detection is on. For other products and the same question, see our agent-desktop security teardown, which covers different tools.
What does it cost, and who can use it?
The pricing page's tools table has a Computer use row. Free tier: "Not available". Paid tier: "Charged as regular tokens per model pricing (e.g., standard Gemini 3.8 Flash pricing)". So the free-tier remark applies to Computer Use specifically; the same pages show free token usage for some of these models in general. gemini-4-argon is stated as not available on the Free tier at all. The figures below are from the standard-rate tab for the paid tier, per 1 million tokens, as the page printed them on November 5, 2026. Each model section also has tabs for other pricing modes, which we did not use; whether Computer Use is offered under those is not stated.
| Model (as listed) | Input per 1M tokens | Output per 1M tokens, including thinking tokens |
|---|---|---|
gemini-4-argon | $2.00 through November 30, 2026; $4.00 starting December 1, 2026 | $10.00 through November 30, 2026; $20.00 starting December 1, 2026 |
gemini-3.8-flash | $0.75 through December 31, 2026; $1.50 starting January 1, 2027 | $3.75 through December 31, 2026; $7.50 starting January 1, 2027 |
gemini-3.5-flash-lite | $0.30 (text, image, video, audio) | $2.50 |
gemini-3-flash-preview | $0.50 (text, image, video); $1.00 (audio) | $3.00 |
Two of the four rates change on a printed date (gemini-4-argon on December 1, 2026 and gemini-3.8-flash on January 1, 2027), so a pilot priced today will not keep the same price. The page gives no token count per screenshot and no worked cost for a task, and we make no estimate of our own: how many screenshots and steps one task needs is something only a test of your own workflow can show. To use the tool you need the Paid tier. For how other agent products describe their costs and limits, see our teardowns of GitHub Copilot cloud agents, Databricks Genie file analysis and the GPT-6.1 Terra system card.
What does Google document about stored interactions and screenshots?
Storage and retention are documented, but on pages other than the Computer Use guide. Google's Interactions API overview says the API stores Interaction objects by default (store=true), retains them for 55 days on the Paid tier and 1 day on the Free tier, lets Paid-tier projects set the window to 7, 14, 28 or 55 days, and lets you opt out with store=false. Its logs policy says logs are retained for a default maximum of 55 days and, by default for billing-enabled projects, prompts and responses within logs are not used for product improvement. Google's release notes for October 26, 2026 say new paid-tier GenerateContent projects now store requests by default, and that existing projects keep their current setting.
No page we read names screenshots, Computer Use or processing regions in this context. We therefore do not call 55 days the screenshot retention period. Whether your screenshots are inside those stored objects, and where they are processed, is a question to put to Google in writing.
What do the docs not say?
Silence on a page is not a denial; these may sit on pages we did not open (available regions, terms, billing FAQ, model cards, the reference implementation). The table separates what the pages state from what we did not find.
| Topic | What the pages state | What we did not find on these pages |
|---|---|---|
| GA status | Changelog, October 30, 2026: Computer Use tool generally available across the Interactions and GenerateContent APIs | A GA label or date on the tool page; which models the GA covers; a GenerateContent example |
| Models | Four models listed, one labelled Preview | Why gemini-3.6-flash, shown as supported on its own model page, is not on the tool page |
| Coordinates | 0-999 integers in tables; a 1000-unit grid converted to screen size in the execution section; pixel coordinates scaled to the screen in the request section | A statement tying the pixel wording to the 0-999 grid |
| Safety policies | Seven categories, overridable via disabled_safety_policies; the API references list all seven as accepted values; a safety_decision may still be returned | How each override behaves |
| Injection detection | Opt-in, default false, for Gemini 3.5 Flash-Lite or later | A detection rate; coverage of gemini-3-flash-preview |
| Accuracy | A supervision caution; the 3.8 Flash description says high-accuracy | Accuracy figures, success rates or benchmarks |
| Rate limits | General rate-limit pages exist | A limit specific to Computer Use |
| Stored interactions | Interactions API: stored by default, 55 days on Paid and 1 day on Free, 7, 14, 28 or 55 days configurable, store=false opt-out; logs default maximum 55 days (Interactions overview, logs policy) | Whether this covers Computer Use screenshots |
| Screenshot handling | The tool page advises your client to log screenshots | A statement naming screenshots in Google's storage or logs |
| Regions | Nothing on the pages read | Where requests are processed |
| Latency and caps | Flash-Lite described as low-latency | Latency figures; session, turn or step caps |
| Service terms | Links to the Prohibited Use Policy and Additional Terms | An SLA for the tool |
| Cost per task | Regular token rates by model | Tokens per screenshot; a worked example |
Do this before a pilot
Three steps that need no production access.
- Pilot only in a throwaway browser profile with no real accounts, and keep confirmations on for every consequential action.
- Ask your developer to switch on prompt-injection detection and test it with a benign test line on a page you own, using a profile with no real accounts.
- Ask your developer or your Google Cloud contact to confirm in writing: rate limits, whether Computer Use screenshots are stored and for how long, and where requests are processed. Treat 'not stated' as unknown.
What should you ask before piloting it?
These are our recommendations, not Google's, for a team that runs ordering, booking, back-office or testing tasks in a browser and wants to try the tool. For where it sits among other agent products, see our comparisons of AI coding agents and enterprise AI agent platforms.
- Which environment will the pilot run in, and does it contain no real accounts, saved passwords or customer data? Google's own advice is a sandbox or a dedicated browser profile.
- Which model will we use, and is it one the tool page lists as Stable rather than Preview? Who owns the model switch if the list changes?
- Who handles
require_confirmation, and what happens on a blocked decision? Does our app halt and log it? - Will prompt-injection detection be switched on, and have we tested it with a benign test line on a page you own, using a profile with no real accounts? The page gives no detection rate, so the test is ours to design.
- Will we log prompts, screenshots, proposed actions and executed actions, as the page advises, and who can read those logs?
- What are the rate limits for our project, and do the 55-day Paid-tier storage and logging defaults cover our screenshots? Would
store=falseor a shorter window suit us, and in which regions are requests processed? Ask Google in writing. - What does one task cost, and which metrics define success (task success rate, wrong-action rate, cost per successful task)? Run a small batch, count screenshots and tokens, and plan for the dated price changes.
- What is our stop rule: which tasks never run unattended, such as payments, account creation and sending messages?
If you want help scoping a pilot, see our AI agents service.
What is still unknown?
The Computer Use, pricing and Models pages print no date, so we cannot say when they last changed; they reflect what was public on November 5, 2026. We did not run the tool and have no data on how it performs. We did not open Google's terms, available-regions page, billing FAQ, deprecations, model cards, reference implementation repository or the Browserbase demo the page mentions. Prices and model lists may change, as the pages themselves show.
Sources
- Google AI Studio documentation: Gemini API release notes, entries of October 30, 2026, October 26, 2026, June 24, 2026, January 29, 2026 and October 7, 2025, read November 5, 2026
- Google AI Studio documentation: Computer use (ai.google.dev/gemini-api/docs/computer-use redirects here), read November 5, 2026
- Google AI Studio documentation: Gemini Developer API pricing, tools table and Standard tabs of four model sections, read November 5, 2026
- Google AI Studio documentation: Models, with the pages for gemini-4-argon, gemini-3.8-flash, gemini-3.5-flash-lite, gemini-3-flash-preview and gemini-3.6-flash, read November 5, 2026
- Google AI Studio documentation: Interactions API overview, section on data storage and retention, read November 5, 2026
- Google AI Studio documentation: Logs policy, read November 5, 2026
- Google AI for Developers: Interactions API reference, safety policy and injection detection fields, read November 5, 2026
- Google AI for Developers: GenerateContent API reference, computerUse and safety policy fields, read November 5, 2026
- Google AI Studio documentation index (llms.txt), read November 5, 2026
- Google AI Studio documentation: Rate limits, checked for any Computer Use entry, read November 5, 2026