Gemini’s New Power: An AI That Can Use Your Computer
Gemini computer control security refers to the protections, risks, and best practices surrounding Gemini 3.5 Flash’s new ability to see screens, control desktops, and automate actions across browsers, apps, and devices on a user’s behalf, effectively turning the AI into a full computer-using agent rather than a mere text assistant.
Google has moved its “computer use” capability into Gemini 3.5 Flash, making agent-style control of browsers, apps, and desktop workflows a built-in feature instead of a separate model. In practice, that means Gemini can watch your screen, understand what is displayed, click buttons, type text, and complete multi-step tasks. In demos, it can browse several travel sites, fill forms, and return the best flight options, or even play games using the on-screen interface.
This is a turning point: Gemini is no longer limited to APIs. It can automate GUI-only workflows such as testing software, filling forms, navigating dashboards, or using legacy apps with no API access. That convenience, however, comes with a price: a much larger attack surface for anyone interested in AI agent hacking risks.
From Helper to Attack Surface: How AI Agents Get Hacked
The moment you give an AI agent control of a screen, you create a new, fragile layer between your data and the internet. With Gemini’s computer use, a model acting on a user’s behalf might encounter untrusted content on screens or make errors in executing actions. That “untrusted content” is not abstract; it includes trap-filled websites designed to hijack AI behavior.
Google itself warns that computer use presents unique security and operational risks. As the number of agentic AI systems on the web grows, hackers are incentivized to exploit them, and websites become the battlefield from which attackers launch attacks on AI agents. A senior scientist at Google DeepMind has already warned that scaled AI agents create incentives “for malicious people to do malicious things”.
This is no longer hypothetical. A cybersecurity expert reported illicit charges to his credit card after an Anthropic Claude agent followed hidden instructions in a skill file and tried to purchase gift accounts using his stored digital wallet. That incident is a clear proof-of-concept for screen control automation threats: if an AI can click, it can spend.
Who Is at Risk Right Now—and How Bad Could It Get?
Computer use with Gemini 3.5 Flash is available today to developers and enterprise customers via the Gemini API and the Gemini Enterprise Agent Platform. These early adopters are the ones most exposed, because they are building agents that automate everything from dashboards to legacy GUI-only tools.
In the short term, the most severe risks sit with organizations that grant Gemini broad permissions: access to production dashboards, financial portals, internal tools, or SEO platforms that log into multiple services. As attack surfaces grow, the greater the likelihood that hackers will seek to exploit them. Malicious actors are already setting traps to steal money from humans by targeting their AI agents, and one such trap has already led to unauthorized credit card charges.
Over time, if these agents move from controlled environments into everyday desktop and mobile use, the severity could escalate from isolated incidents to systemic abuse of automated workflows. The uncomfortable truth: agentic AI security is now as important as traditional endpoint security for anyone experimenting with screen-controlling agents.
Google’s Safeguards Help—but They Are Not a Force Field
Google is not blind to the risks. For Gemini 3.5 Flash, it has used targeted adversarial training and introduced two key safeguards: the model can be configured to require explicit user confirmation before sensitive or irreversible actions, and it can automatically stop tasks when it detects a prompt-injection attack. On top of that, Google publishes safety best practices that stress human-in-the-loop controls, secure environments, and guardrails.
Those best practices include enforcing user confirmation when the safety system indicates require_confirmation, and adding custom safety instructions to define your own boundaries. They also call for running agents in secure, sandboxed environments like isolated VMs or dedicated browser profiles. Content guardrails and safety APIs should inspect user inputs, tool outputs, and agent responses for prompt injection or jailbreak attempts.
These measures are necessary but not sufficient. They reduce risk; they do not eliminate it. The threat landscape is evolving faster than any policy document, and any developer who treats Gemini’s safeguards as a force field, rather than a safety net, is inviting trouble.
Practical Rules: When to Trust an AI with Your Screen
If you are going to let an AI agent click and type on your behalf, you need a clear permission model and a bias toward skepticism. The safest default is to restrict what the agent can see and do, and then widen that scope only when necessary.
- Keep human-in-the-loop: require explicit confirmations for anything involving payments, credentials, or irreversible changes.
- Use a secure sandbox: run Gemini agents in a dedicated VM, container, or limited browser profile so mistakes cannot touch your main system.
- Control where agents can go: maintain blocklists of prohibited websites and, where possible, allowlists of approved destinations.
- Sanitize and monitor: clean user inputs, apply content guardrails for prompt injection, and log prompts, screenshots, suggested actions, and final actions for auditing.
- Stabilize the environment: start from a known, clean GUI state and reduce pop-ups or layout changes that could confuse the model.
Site owners also have work to do. They may need stronger bot controls and tools to spot hidden prompt-injection instructions planted on their pages.
The conclusion is blunt: Gemini’s computer use is powerful and worth using, but only if you treat it like giving a contractor keys to your office—never full ownership of the building.
