Your AI Can Now Control Your Desktop. That’s Either Exciting or Terrifying.
I watched an AI use Chrome on a real computer last Tuesday. Open a tab, scroll, click the right button, and close it. Took about eight seconds. I don’t know why I found it unsettling — I’ve been using AI assistants for two years now — but watching something actually navigate a desktop interface instead of just generating text felt different. Wrong-word different. Like watching a video of your own house being robbed.
Google shipped that capability to Gemini 3.5 Flash last week. Computer use, integrated natively — no separate model, no standalone Gemini 2.5 install. If you’re running the Gemini API or the Enterprise Agent Platform, it’s there. Observe, reason, and act across browser, mobile, and desktop. The whole thing.
The automation angle is real. Enterprise teams have been experimenting with AI agents that can handle continuous software testing, knowledge work, research loops — anything with a repeatable interface. Having that built into Flash instead of a separate model simplifies the stack. One API call instead of two. That matters when you’re building workflows at scale.
But here’s what the blog post spent the most words on, and it wasn’t the automation features.
Security. Specifically: prompt injection.
If you give an AI agent access to your browser and desktop, and it encounters malicious content while browsing — a poisoned webpage, a crafted email in your inbox it’s reading for you — can it be tricked into doing something the user didn’t intend? This is the central unsolved problem of computer-using agents. Google knows it. They trained adversarially against prompt injection specifically, and they added two optional enterprise safeguard systems that halt risky tasks pending human confirmation.
That’s honest. More honest than most enterprise AI rollouts I’ve seen. The headline feature was “our AI can now control your computer.” The fine print was, “and we’ve spent a lot of engineering cycles trying to make sure it doesn’t do something stupid when it encounters something malicious.”
The safeguards are optional, not on by default. Which means the organizations that understand the risk will turn them on, and the ones that just want the automation to work will leave them off and hope for the best. Enterprise IT has a bad track record with “optional security features.” Just saying.
I’m genuinely torn on this one. Computer use in a flagship model is a real capability step — the kind of thing that makes you rethink what “using a computer” even means. But the threat model is genuinely hard. The difference between “AI agent reads your email and summarizes it” and “AI agent reads your email and clicks a link it shouldn’t” is one bad prompt injection away.
We’ve requested access to the enterprise platform. I’ll let you know what our security team says when we show them this.
