Google makes Gemini Computer Use generally available in two APIs

Google has moved Computer Use, the Gemini tool that reads screenshots and proposes clicks, scrolls and keystrokes, to general availability. Google’s Gemini API changelog dated October 30, 2026 says the tool is now generally available across the Interactions and GenerateContent APIs. The most important fact for builders has not changed: the model only suggests an action, and the developer’s own application still has to carry it out and build the safety handling around it.

General availability, often shortened to GA, marks the point where a feature leaves preview status. As Forkast puts it, the announcement “changes the tool’s status, not the division between a model’s suggestion and an executed action”. The model’s response is a proposal, not a completed interaction.

What Google released on October 30

The changelog describes Computer Use as a model tool for interacting with browser, mobile and desktop environments. It is available through two Gemini APIs: the Interactions API and the GenerateContent API. Google’s documentation lists example tasks including filling in forms, testing web applications and researching product information across websites. Forkast notes that these are documented use cases, not evidence of adoption or independent testing.

The sources give no pricing, regional restrictions or model list for the GA release. They also do not say whether a waitlist applies. The documentation does say that for Gemini 4 and Gemini 3.x models, responses can include an intent field that explains why the model chose an action.

Item	What the sources state
Status	Generally available, per the October 30, 2026 changelog
APIs	Interactions API and GenerateContent API
Environments	Browser, mobile and desktop
Input to model	Request, configuration, prompt and screenshot
Output from model	A suggested function call such as a click, scroll or key press
Action reasoning	Intent field for Gemini 4 and Gemini 3.x models
Safety decision values	Allowed, requiring confirmation, or blocked
Prompt-injection detection	Opt-in, disabled by default
Recommended execution environment	Sandboxed virtual machine or container

How the GA tool differs from the 2025 preview

Computer Use started as a specialised model. In October 2025, heise reported that Google presented Gemini 2.5 Computer Use, a model built on the visual and reasoning capabilities of Gemini 2.5 Pro and specialised in using the web through a browser in the way people do. It was offered through the Gemini API in Google AI Studio and Vertex AI. A Medium write-up from the same month gave the preview’s identifier as gemini-2.5-computer-use-preview-10-2025.

At the time, heise reported that the model was optimised for web browsing and did not perform as well on mobile interfaces. The GA documentation now describes browser, mobile and desktop environments. The sources do not include any new data on how well the GA tool performs in each of those environments, so the documentation should not be read as proof of equal quality across all three.

The other visible change is where the tool runs. The preview was a dedicated model. The GA documentation describes an intent field for Gemini 4 and Gemini 3.x models, which suggests the capability is tied to newer model families. The sources do not give a full list of supported models.

The loop developers still have to build

Google’s documentation describes a loop with four steps:

1. The application sends a request, configuration, prompt and screenshot to the model.
2. The model analyses the screen and returns a suggested function call, such as a click, scroll or key press. A function call is structured output that describes an action. It does not perform the action.
3. The client parses the call and executes it in the target environment.
4. The client captures the changed screen and returns it to the model for the next step.

The work is therefore split between the model call and the client’s execution code. One detail shows that the client is more than a thin wrapper. The model’s coordinates are normalised to a reference screen scale, and client code has to map them to the actual viewport before it executes a click. Coverage of the 2025 preview described this reference as a standardised 1000x1000 grid. Google’s examples use automation tools such as Playwright, the browser-automation library, to perform the actions.

The Medium author, who tested the preview, warned that the workflow “looks deceptively simple”. In practice, the author wrote, developers end up building a state machine that handles errors, timeouts and unexpected interface changes. The same write-up flagged rate limits, occasional nonsensical action proposals, and trouble with responsive designs that change layout sharply depending on viewport size. These observations come from one tester working with the 2025 preview. They have not been confirmed for the GA release.

For a comparable approach that runs locally, see the earlier Unicorn API report on Microsoft’s open-source Mage-VL-Cowork agent that operates a PC.

Safety signals Google returns, and who acts on them

The model’s response can carry information that helps the client decide how to handle a proposed action. A safety decision can classify an action in one of three ways: allowed, requiring confirmation, or blocked. Google’s guidance says the client should halt execution or handle an interruption when an action is blocked. Forkast stresses that the application still has to implement this path. If the client code ignores a “blocked” or “requires confirmation” signal, nothing in the loop described by the sources stops the action from running.

The confirmation step dates back to the preview. heise reported that the 2025 model could ask the person who gave it a task before acting, to avoid, for example, buying 100 pairs of socks in the wrong size. The Medium write-up described user confirmation for sensitive operations such as purchases or legal agreements, and a rule against bypassing security measures such as CAPTCHAs.

Prompt-injection detection is off unless enabled

Prompt injection means hiding instructions in content the model reads, so that the model follows the attacker instead of the user. Google’s guide shows prompt-injection detection disabled unless a developer turns it on. When enabled, it scans screenshots for hidden adversarial instructions. This matters for Computer Use because the model reads interface content as well as acting on it. Forkast notes that indirect prompt injection is a documented security concept, not evidence that an attack has occurred in any particular deployment.

Isolation is recommended, not automatic

Google recommends running the execution environment in a sandboxed virtual machine or container, isolated from the host. This is a recommendation. It does not mean every implementation is isolated automatically.

Google’s own limits on where to use it

The documentation warns that Computer Use may contain errors and security vulnerabilities. Google recommends close supervision for important tasks. It advises against using the tool for critical decisions, for sensitive data, or for actions where serious errors cannot be corrected. In Forkast’s reading, whether the tool suits an application depends on what that application is allowed to do and how reversible its actions are.

The only performance figures in the sources describe the 2025 preview, not the GA release. The Medium write-up reported that on the Online-Mind2Web benchmark, which covers 300 tasks across 136 websites, Gemini 2.5 Computer Use reached roughly 70% accuracy, with shorter response times than other publicly evaluated systems. The write-up does not say who ran that evaluation. The author also reported success rates of around 70% in their own tests on web forms, shopping sites and calendar tasks. Failures clustered on sites with unusual layouts or heavy JavaScript. Forkast’s conclusion about the GA release is blunt: it “establishes availability, not performance, adoption or workflow reliability”.

What it means for builders

The GA label gives teams a supported status to build on, through two APIs. The engineering work stays the same. According to Google’s guide, a production integration needs these pieces:

• An action handler that parses function calls and maps normalised coordinates to the real viewport.
• An execution environment, ideally a sandboxed VM or container.
• A screenshot loop that captures the state after each action and returns it to the model.
• Safety-decision handling that pauses for confirmation and halts on blocked actions.

Teams that let the agent read untrusted pages should consider enabling the opt-in prompt-injection detection, because it is off by default. Teams that already use the intent field on Gemini 4 or Gemini 3.x models can log why each action was chosen, which makes audits easier.

Gemini is not the only option. heise noted in 2025 that Anthropic’s Claude has a computer-use mode that also analyses screenshots, and that OpenAI’s Operator and ChatGPT Agent work with screen recordings to fill in forms and complete similar tasks. The sources offer no current head-to-head comparison between these tools. heise also reported that variants of the 2025 model supported Google’s AI Mode search and Project Mariner, Google’s agent project.

What to watch next

• Independent results for the GA tool, especially on mobile and desktop. The only performance figures in the sources describe the 2025 browser-focused preview.
• Whether prompt-injection detection stays opt-in, or whether Google moves it toward being on by default.
• Clarity on supported models, pricing and regions. None of these appear in the sources for the GA release.
• Real deployments. Forkast notes that the listed use cases are not evidence of adoption.