Gemini Computer Use Reaches GA: Which Model to Run It On

Google just moved Gemini Computer Use out of preview, so the question shifts from "can the model click a button?" to "which model gets to click it, and what stops it clicking the wrong one?" The Gemini API changelog for October 30, 2026 lists the Computer Use tool as generally available (GA) across the Interactions and GenerateContent APIs. Below: which model to run it on, what it costs, and which safety settings to switch on first.

What GA means for Gemini Computer Use

The changelog entry names no models, so the rest comes from the Computer Use docs and the pricing page.

The mechanics are unchanged: the model reads a screenshot and returns an action such as a click or a keystroke, your code runs it (the docs use Playwright) and sends a fresh screenshot back, and the loop repeats until the model stops asking for actions.

One caveat: the docs still warn that Computer Use may contain errors and security vulnerabilities, and recommend close supervision for important tasks. GA doesn't remove that warning.

Which model to run Gemini Computer Use on

Prices are per 1M tokens (input / output, thinking tokens included in output) on the standard paid tier.

| Model | API ID | Docs describe it as | Price | | --- | --- | --- | --- | | Gemini 3.8 Flash | gemini-3.8-flash | The recommended model | $0.75 / $3.75 through Dec 31, 2026, then $1.50 / $7.50 | | Gemini 4 Argon | gemini-4-argon | Most capable, for complex reasoning and agentic UI workflows | $2.00 / $10.00 through Nov 30, 2026, then $4.00 / $20.00 | | Gemini 3.5 Flash-Lite | gemini-3.5-flash-lite | Low-latency and cost-effective | $0.30 / $2.50 |

The docs also list gemini-3-flash-preview, still labelled a preview model, so I'd skip it for production.

Computer Use adds no surcharge: the pricing page says it is "charged as regular tokens per model pricing". Every step sends a screenshot back, so cost grows with step count, and a model that finishes in 8 steps can beat a cheaper one that wanders for 30. Neither page gives per-task cost, so measure it on your own tasks.

My pick: start on 3.8 Flash, as the docs recommend. Try Flash-Lite for short, repetitive flows where latency matters. Reach for Argon only when Flash fails your own test set.

Turn on prompt injection detection first

A screen-driving agent reads whatever the page shows, including text a stranger planted there. Prompt injection detection is opt-in (default false) and, per the docs, supported on Gemini 3.5 Flash-Lite or later. It scans screenshots for hidden adversarial instructions and blocks execution when it finds one. You need google-genai 2.7.0 or higher.

from google import genai

client = genai.Client()

interaction = client.interactions.create(
    model="gemini-3.8-flash",
    input="Find a flight from SF to Hawaii on Jun 30th, coming back on Jul 6th",
    tools=[{
        "type": "computer_use",
        "environment": "browser",
        "enable_prompt_injection_detection": True,
    }],
)
print(interaction.steps)  # function_call steps to execute in your loop

This starts the loop. On later turns, send your function_result items with previous_interaction_id=interaction.id and repeat the same tools block. The model returns normalized coordinates, so scale them to your viewport.

Handle require_confirmation in your agent loop

A function call can carry a safety_decision. When its decision is require_confirmation, ask a human. If they approve, set safety_acknowledgement to true in that action's result. If they decline, stop the loop. For blocked actions, halt or handle the interruption.

def handle_call(call, page):
    safety = call.arguments.get("safety_decision")
    approved = False
    if safety and safety.get("decision") == "require_confirmation":
        print(f"Confirm: {safety.get('explanation', '')}")
        if input("Proceed? [y/N] ").strip().lower() != "y":
            return None  # declined: stop the loop
        approved = True
    result = execute_action(call, page)  # your Playwright wrapper
    if approved:
        result["safety_acknowledgement"] = True
    return result

I'd leave disabled_safety_policies alone: it only states a preference, and the model may still return require_confirmation.

Where to point a screen-driving agent

Run it in a sandboxed VM, container or limited browser profile (see google/computer-use-preview for a Docker reference), restrict it to allowlisted sites, and log prompts, screenshots, function calls and safety responses.

Keep a human on payments, sending messages, legal terms, CAPTCHAs and logins. And if the system has a real API, use the API: it is cheaper and more predictable than pixel-clicking.

What to do Monday morning

1. Run pip install -U google-genai playwright, then playwright install chromium, and confirm google-genai is 2.7.0 or higher.
2. Run one real task on gemini-3.8-flash inside a container, with injection detection on and a turn limit.
3. Replay it on Flash-Lite and Argon and compare cost per completed task, before the December 1 and January 1 price changes.
4. Wire require_confirmation to a person before the agent touches a real account.

GA gives you a supported tool, not a safe one by default, so in production the sandbox, the confirmations and the logs around the model matter more than which Gemini you pick.