Gemini 3.5 Flash Computer Use shows browser and desktop agents moving to workflow automation

Google released Gemini 3.5 Flash Computer Use on June 26, 2026. The update gives agents direct control over browsers, mobile screens, and desktop environments. It adds intent arguments, human takeover points, and action-level safety rules. Google AI Blog (9to5Google)

Teams that previously ran separate scripts for each app can now test one agent across several tools. The change matters because many agents still fail when windows resize or login screens appear. Gemini 3.5 Flash Computer Use tries to handle those moments without restarting the whole task.

Google ships working hooks for handoff and recovery

The release includes four concrete additions. First, built-in support for mobile and desktop operating systems. Second, every function call now carries intent arguments that describe the goal - for instance, an agent attempting a vendor payment would receive the explicit intent “pay invoice under approved budget limit” rather than isolated click commands, reducing missteps on dynamic forms. Third, developers can register custom client functions that pause the agent and wait for a person; when a two-factor authentication screen appears, the agent halts and surfaces its planned next steps for immediate user confirmation before proceeding. Fourth, prompt injection detection runs at the action level with configurable policies, such as blocking any attempt to access banking domains until human approval is granted.

# Pseudo-code example
if intent == "pay_invoice" and action.target_domain in ["bank.com"]:
    if not safety_policy.approved:
        return pause_for_human_review(action)
execute(action, intent_args={"budget_limit": 5000})

These features replace earlier demos that crashed on simple changes such as a new button or a two-factor prompt. The hooks let an agent stop, show its plan, accept edits, and continue. That pattern matches how support teams already review automated tests before they touch production data. Bloomberg

Why computer-use agents need recovery paths to reach daily work

Most browser agents still run in isolation. They cannot read meeting notes or pull pricing decisions made last month. When a step fails, the agent either loops or hands the user a blank slate. Gemini 3.5 Flash Computer Use reduces the blank-slate problem by exposing clear pause points.

Knowledge workers still need the agent to know the difference between a QA test and a real purchase order. Without that background, even accurate clicks produce wrong outcomes. Agents that pause at intent boundaries give people a chance to supply the missing context before money or customer records move.

The pressure on general agents without grounded context

Manus, OpenAI agents, and similar tools run on short session memory. They require fresh explanations of company process, file locations, and approval chains every time. Gemini 3.5 Flash Computer Use still starts from the same short memory. The difference is that its new hooks make it easier to insert longer context at the moment it matters.

Teams that already keep notes, decisions, and files in one place can feed that material into the pause points. Agents that lack such storage continue to demand repeated setup. The gap shows up most clearly in multi-step processes that span email, spreadsheets, and internal dashboards.

Where safety policies actually limit automation today

The prompt injection filter and action-level rules reduce the chance that an agent accepts a spoofed email as a valid instruction. They also block actions on certain domains or file types unless a human approves. These limits are useful for compliance teams.

They also slow down open-ended tasks. A finance agent that must ask before every vendor payment will still need review time. The safety layer trades speed for control, which matches the priorities of regulated industries more than creative departments.

What to watch in the next three months

Three signals will show whether the new hooks move agents into real workflows. First, release notes from companies that already run large QA suites, tracking metrics such as “percent of test cases completed without manual intervention.” Second, any public examples of agents completing end-to-end purchase orders or report submissions without manual fixes, measuring reductions in average task time. Third, updates from competing agent frameworks that add similar pause and handoff features, monitoring GitHub adoption indicators. The Verge

If one of these signals appears, the pattern of grounded, recoverable agents will look more durable than short-session demos. Readers who track these updates can judge whether the shift from demo to daily tool has started in their own work.