Yesterday, while most of us were still talking to AI, Google quietly handed it the mouse.

On October 30, the Gemini API changelog recorded a short line with long consequences: Computer Use is now generally available across the Interactions and GenerateContent APIs. In plain language, a developer can now build an agent that looks at screenshots of a screen, decides what to do, and proposes the next click, scroll, or keystroke. The program running on your computer still has to carry the action out, and Google is blunt about the limits: the tool can make mistakes, it can carry security flaws, and important tasks need close supervision. It warns against using it for critical decisions, sensitive data, or anything where a wrong click cannot be undone.

That warning is the whole story, because this was also the week trust broke somewhere else. On October 29, tampered copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, sat in Cursor's extension marketplace for about eleven hours and reached at most 5,000 users. They planted a persistent SSH backdoor, and Cursor warned that simply uninstalling the extension would not remove it. Anthropic says its own systems were not compromised; someone abused access to Cursor's marketplace instead. Read those two facts together and the picture sharpens: we are giving AI agents hands, and the hands reach through software we install without ever really inspecting it.

OpenAI, on the same day, October 30, moved in the opposite direction and gave its chatbot a different kind of hand: the power to stop. ChatGPT will now hold back practical weapons and security-system information from accounts it predicts belong to teens, even when the question looks harmless, and it will be able to end a conversation on its own when someone seems fixated on violence, with repeated endings able to pause an account. A first Community Safety Report is promised for early 2027. So in one week, one company shipped an AI that can press buttons for you, and another shipped an AI that can refuse to keep talking to you. Both are decisions about agency, not about smarter answers.

There is a calmer version of this future, and it arrived from an unlikely place: planning offices in England. Google DeepMind says its Gemini-built PlanAssist cut the time officers spent on householder assessment tasks by 58% in early pilots across three councils, and it is now moving into a twelve-month beta with twelve more councils. The detail that matters is not the percentage. It is that officers keep the final say on every application. The machine drafts fully cited reports; a human still signs.

So here is where I land, and I genuinely want to argue about this. I am not afraid of an agent that can click. I am afraid of an agent that clicks while nobody is watching, through tools nobody checked, on tasks nobody can undo. The question is no longer whether AI can use a computer. It can, and from now on it will, in production, not in demos. The question is what we keep for ourselves: the final click, the final signature, the right to say stop.

Tell me honestly. What is the first task you would hand to an agent tonight, unsupervised, and what is the one task you would never hand over, no matter how good it gets? Your answer is the policy the whole industry is still missing.