Google put computer control into Gemini. The stop button matters most.

Computer use changes the unit of trust

Traditional automation works best when a service provides a narrow API: read this field, create that calendar event, return a known result. Computer use asks the model to interpret pixels and controls meant for humans. It can operate software that offers no formal integration, but it also inherits every ambiguity in the interface.¹

A button can move after an update. A confirmation dialog can resemble an advertisement. Two accounts can share the same browser. The agent needs to infer both what the control does and whether the current user intended that action. Better visual reasoning reduces errors; it does not remove the need for limits.^1,2

This is why broad access should not be the default. An agent that books travel may need a browser profile, but it does not need access to a password manager, personal cloud drive and work email at the same time. The safe unit is a restricted task environment, not the user's entire desktop.²

A hidden sentence can redirect the agent

Indirect prompt injection occurs when the agent encounters hostile instructions inside material it was asked to read. A webpage, document or image can contain instructions aimed at the agent rather than the user. The person may never see the command that the model follows.^1,2

OWASP treats prompt injection as a central risk for systems that combine language models with tools. The practical danger grows with authority. A read-only research agent may leak information into its answer. An agent with email, file and payment access can create an external consequence before the user knows the task changed.²

Google says it used adversarial training and offers a safeguard that stops a task when indirect injection is detected. Detection will not be perfect. The safer assumption is that hostile content will sometimes pass through, so the environment must still limit what an agent can reach and what it can do without approval.^1,2

Confirmation should describe the consequence

A useful confirmation is specific: send this email to these recipients, buy this item for this total, or delete these named files. A generic prompt asking whether the agent may continue encourages automatic approval. People stop reading warnings when every ordinary step looks equally dangerous.^1,2

Google's safeguard can require explicit approval for sensitive or irreversible actions. Developers decide how to apply it, which means two products built on the same model may behave very differently. Users should look for confirmation design and audit history rather than assuming the model name guarantees a safety level.¹

A safer agent design would also show the source of the requested action. If a cancellation began because an email contained a command, the confirmation should identify that email. Without provenance, the user cannot distinguish their own instruction from something the model discovered along the way.

How to test an agent without donating your accounts

Start with a separate browser profile and a low-value account. Remove saved payment methods, personal documents and password-manager access. Give the agent one task with an outcome you can inspect, such as organizing copies of test files or collecting public information into a draft.²

Keep approval on for sending, purchasing, publishing, deleting and changing account settings. Review the action log after the task, including failed attempts. A successful final result can hide several wrong clicks or unexpected pages that would matter in a more sensitive workflow.^1,2

As a general security practice, do not paste a long-lived API key into a prompt or place credentials in a document the agent reads. Use scoped tokens, temporary sessions and service permissions that can be revoked. If the product cannot explain what it stores, what it records and how to disconnect it, do not connect a primary account.

The capability is real, the delegation remains optional

Computer use can make inaccessible software automatable and reduce repetitive office work. It can also turn the messy visual layer of computing into an execution surface for model mistakes and hostile content. Both sides follow from the same flexibility.^1,2

Integrating computer use into Google's main Flash model lowers the implementation barrier for developers. The announcement does not establish that an agent can safely manage an unsupervised personal machine. That claim would require independent testing across real accounts, changing interfaces and deliberate attacks.¹

For now, treat computer use as supervised automation. Give it a small room, not the master key. The model can move the cursor; the user still owns the consequences.^1,2

• Use a separate browser profile and low-value test account.
• Require specific confirmation for sends, purchases, deletes and account changes.
• Limit the files and services visible during each task.
• Review the action history, not only the final result.