Google’s changelog entry for October 30 says Computer Use is generally available across the Interactions and GenerateContent APIs. The model reads screenshots your code sends and returns UI actions for your code to execute against a browser, phone or desktop. Four models support it, and the docs page shows only Interactions API examples. In Python you need google-genai 2.7.0 or later; the page gives no version for other languages. Gemini API changelog · Computer use docs
S5 Labs has not run the tool. We found no Google computer-use benchmark and no independent test, so this is a reading of the docs and the pricing page, not a performance review. The one outside comparison is OpenAI’s GPT-6.1 Terra, which we covered on October 26 and whose model page we reopened today.
The minimal call
The whole opt-in is one tool entry:
tools=[{"type": "computer_use", "environment": "browser"}]with model="gemini-3.8-flash". Everything else on the page, from safety policies to prompt-injection detection, is configuration around that call or a field you read out of the response. Computer use docs
Two dated changelog entries sit next to the GA note and matter for a computer-use agent. On October 26, new paid-tier GenerateContent projects began storing requests by default; existing projects keep their current setting. A computer-use agent sends screenshots of whatever it is working in, so check that setting before pointing the tool at anything with customer data; our logging-default explainer covers what store=false does and does not stop. On October 27 a Gemini API CLI entered beta. Gemini API changelog
Which model
Google’s descriptions, quoted from the docs page:
| Model | Google’s description | Standard price, in / out per 1M tokens |
|---|---|---|
gemini-4-argon | “Our most capable model, supporting computer use for complex reasoning and agentic UI workflows.” | $2.00 / $10.00 through Nov 30, then $4.00 / $20.00 |
gemini-3.8-flash | “The recommended model for computer use, featuring high-accuracy UI interaction and reliable tool calling.” | $0.75 / $3.75 through Dec 31, then $1.50 / $7.50 |
gemini-3.5-flash-lite | “A low-latency, cost-effective model supporting computer use.” | $0.30 / $2.50, no end date listed |
gemini-3-flash-preview | “Preview model supporting computer use.” | $0.50 text, image, video ($1.00 audio) / $3.00 |
Computer use docs · Gemini API pricing
The practical reading: start on 3.8 Flash, which is both Google’s recommendation and the example model in the docs, move hard tasks to Argon, and drop to 3.5 Flash-Lite where a slow step costs more than a wrong one. “Recommended” and “low-latency” are Google’s words; nothing on the page quantifies either.
Two deprecation entries from October 8 affect anyone arriving from an older Flash model. Gemini 3.7 Flash is deprecated and routed to 3.8 Flash, which is on the computer-use list. Gemini 3.5 Flash is deprecated and routed to 3.6 Flash, which is not. A pipeline that relied on 3.5 Flash should be re-pointed to one of the four models above rather than left to the routing. Gemini API changelog
Three environments
The environment value fixes the action vocabulary the model can return; your side performs each action against a real browser, device or desktop.
| Environment | Actions | Navigation actions |
|---|---|---|
browser | 20 | navigate, go_back, go_forward |
mobile | 10 | go_back only |
desktop | 17 | none |
The browser set is: click, double_click, triple_click, middle_click, right_click, mouse_down, mouse_up, move, type, press_key, key_down, key_up, hotkey, drag_and_drop, wait, take_screenshot, scroll, go_back, navigate and go_forward. The desktop set has no navigate, go_back or go_forward, so a desktop agent that needs to open a URL has to get there through clicks and typing. Computer use docs
If you already run Holo4 or another open-weight GUI model, the executor you wrote for it is the part that carries over; the action names and the safety fields below do not.
The intent field
For Gemini 4 and Gemini 3.x models, each action’s arguments include an intent string: the model’s explanation of why it is taking that step. Computer use docs
That is worth logging on every action, next to the screenshot and the action arguments. It gives a reviewer a per-step narrative when a run goes wrong, and it gives a policy layer something to match against before the executor fires. It is also the model’s own account of its reasoning, generated alongside the action, not a verified record of what the model did. A logging pipeline that stores only intent without the screenshot and the executed action has an audit trail written by the thing being audited.
Two traps
Prompt-injection detection is off
The docs describe an “advanced safety mechanism to detect prompt injection attacks” for “Computer Use for Gemini 3.5 Flash-Lite or later”. It is opt-in through enable_prompt_injection_detection, and the default is false. Computer use docs
That wording covers 3.5 Flash-Lite, 3.8 Flash and Argon. It does not name gemini-3-flash-preview, so we would not assume the preview model has it. A computer-use agent reads whatever page it lands on, and a page can carry instructions aimed at the model. Turning the detector on should be the first line of any production config, and turning it on is not the same as having tested it: the page says nothing about detection rates.
Safety overrides still need a handler
Every action can come back with a safety_decision. The docs describe three outcomes: regular (allowed), require_confirmation and blocked. require_confirmation is the only value written out literally. When you get it, the expected flow is to ask the user, then send the action’s function_result back with safety_acknowledgement set. The blocked case is described in less detail, so do not build a schema for it from this page. Computer use docs
You can relax the checks with disabled_safety_policies; the example value is data_modification. The seven policy categories are FINANCIAL_TRANSACTIONS, SENSITIVE_DATA_MODIFICATION, COMMUNICATION_TOOL, ACCOUNT_CREATION, DATA_MODIFICATION, USER_CONSENT_MANAGEMENT and LEGAL_TERMS_AND_AGREEMENTS. The docs list the names without further definition.
The sentence that matters most for client design comes after the overrides: “the model may still return a safety_decision with require_confirmation in some cases.” So the override is a request to the model, not a switch on your side. A client that disables a policy and stops checking safety_decision can receive a confirmation request it does not handle and either stall or, worse, execute the action anyway. The handler has to exist regardless of configuration. Computer use docs
Google’s own framing backs this up. The page states that “Computer Use may contain errors and security vulnerabilities”, advises against using it for critical decisions, sensitive data or actions that cannot be corrected, and says: “Run your agent in a sandboxed VM or container to isolate it from your host system and limit its potential impact.” That is the vendor describing a GA product, and it is a constraint on scope. Computer use docs
What it costs, next to Terra
The computer-use page has no price. The pricing page says the tool has no separate rate: computer use is billed as ordinary tokens at the model’s rate. Screenshots are part of the input, and we found no per-screenshot token count for these models, so no honest per-task figure exists yet. What can be stated is the price of a fixed token budget. Gemini API pricing
OpenAI’s Terra model page, reopened today, lists Standard rates of $1 per million input and $5 per million output tokens for prompts up to 272K input tokens, with input and cache rates doubled and output at 1.5x for the whole request above that line. Computer use is on its supported-tools list, which is scoped to the Responses API. GPT-6.1 Terra model page
Take 100,000 uncached input tokens and 10,000 output tokens at Standard rates, with no cache hits, tool surcharges or batch discounts. This is S5 Labs arithmetic from the vendor rates above:
| Model | Now | After the price step |
|---|---|---|
| Gemini 4 Argon | $0.30 | $0.60 from Dec 1, 2026 |
| Gemini 3.8 Flash | $0.1125 | $0.225 from Jan 1, 2027 |
| Gemini 3.5 Flash-Lite | $0.055 | no change announced |
| Gemini 3 Flash Preview | $0.08 | no change announced |
| GPT-6.1 Terra | $0.15 | no change announced |
Argon costs twice Terra today and four times Terra from December, so it only makes sense on tasks where 3.8 Flash and Terra both fail. 3.8 Flash undercuts Terra by a quarter until January, then costs half again as much, which is the same introductory-price pattern we flagged for 3.8 Flash in September and Argon in October. Flash-Lite is the cheapest row, with no expiry listed. After both step-ups, it and the 3 Flash preview are the only Google rows still below Terra, and the preview carries a preview label.
None of this is a task cost. A model that needs more screenshots or more retries to finish spends more, and the vendor with the cheaper token can still be the more expensive agent. Cached input changes the picture too: Argon’s cache rate is $0.10 per million through November, 3.8 Flash’s is $0.075 and Flash-Lite’s $0.03, while 3.8 Flash and Flash-Lite also carry a cache storage charge ($0.50 and $1.00 per million tokens per hour respectively; 3.8 Flash’s doubles in January). A long-running agent with a stable system prompt and a growing screenshot history will see a different ratio from the table. Gemini API pricing · GPT-6.1 Terra model page
The checklist
Pick the model by failure, not by name. Run the same task set on 3.8 Flash first. Move to Argon only for tasks it fails, and to Flash-Lite only where you have measured that latency matters more than accuracy.
Set enable_prompt_injection_detection to true before the first real page. Then test it: feed the agent a page with embedded instructions and record what the detector does, because the docs give no rate.
Handle every safety_decision value, with overrides or without. Implement the require_confirmation path with safety_acknowledgement, a stop for blocked, and a default that halts on anything unrecognised. Do not let disabled_safety_policies remove the handler.
Log intent, the screenshot and the executed action together. The intent alone is the model grading itself.
Run the executor in a disposable VM or container. Google says so for its own product. Give it credentials that can be revoked and nothing that touches payments, customer records or outbound mail until you have run the policy categories above against your own task list.
Check the request-storage setting. New paid-tier GenerateContent projects store requests by default since October 26. Screenshots of a logged-in session are the input.
Price both step-ups. A budget on 3.8 Flash should show the January figure; one on Argon the December figure. If a run must stay under Terra’s cost after both, Flash-Lite is the only GA Google model that does on token price alone.
Measure screenshots per task. Until Google publishes image token counts for these models, the number of screenshots a run consumes is the cost driver you can see.
Sources
Google documentation: Computer use · Gemini API changelog · Gemini API pricing
OpenAI documentation: GPT-6.1 Terra model page
Related S5 Labs coverage: GPT-6.1 Terra pricing and computer use · Gemini 4 Argon pricing and migration · Gemini 3.8 Flash pricing and Flash Cyber · Holo4 computer-use models and licenses