AI Agents That Can Use Your Computer: What's Actually Real in 2026, and What's Still a Demo

"AI agent" now means almost nothing. It gets stapled onto chatbots with a to-do list, onto workflow builders that have existed since 2011, and onto the one category where the phrase is doing real work: systems that look at a screen, move a cursor, and click through a workflow without a human driving.

That second category is real. It ships. It is measurably better than it was eighteen months ago. It is also, in a way most coverage misses, further from "solved" than it was a year ago — because the benchmarks got honest.

This is an updated look at what the major vendors have actually published, what they have quietly killed, and where the gap between the demo reel and your Tuesday afternoon still sits.

The scoreboard everyone quotes is finished

Start with the number that made the rounds.

Anthropic launched computer use as a public beta with Claude 3.5 Sonnet in October 2024. The model could read a screenshot and issue mouse and keyboard actions. Anthropic reported 14.9% on OSWorld with a single screenshot, and 22.0% when the model was given more steps. OSWorld is a set of real desktop tasks — edit this file, change that setting, navigate this app — run on an actual operating system.

Both figures beat the field at the time. Both also meant failing most tasks.

OpenAI's Computer-Using Agent shipped in January 2025 behind Operator and posted 38.1% on the same benchmark, described as state of the art. It was. A human doing those same 369 tasks scores about 72.4%.

By early 2026, frontier agents had blown past that human line. Independent harnesses were posting 81–84%. The public OSWorld-Verified leaderboards now show Alibaba's Qwen3.8 Max at 86.1%, with Claude Fable 5 and Mythos 5 around 85%, as of the 4 September 2026 update.

Here is the part that doesn't make headlines: the OSWorld 2.0 authors note that frontier agents are now saturated at 79–83% on the original benchmark. When a test tops out, it stops discriminating between systems. Every additional point is noise, scaffold tuning, or grader quirk.

So the researchers built a harder one, and the results are sobering.

OSWorld 2.0, or what happens when the tasks get real

OSWorld 2.0 landed on arXiv on 28 June 2026, out of XLANG Lab at the University of Hong Kong with support from Snorkel AI's benchmark grants programme. It has 108 tasks instead of 369, and that's the point. These are long-horizon professional workflows across 31 self-hosted web environments and desktop applications: research, engineering, finance and operations, compliance, healthcare, document production.

The scale difference is the story:

That last row matters more than anything else in this article.

When the paper was written, the best configuration tested — Claude Opus 4.8 at maximum thinking with batched tool calls — finished 20.6% of tasks outright. Its partial-credit score was 54.8%. GPT-5.5 came in at 13.0% binary. Claude Opus 4.7 at 18.2%.

Same models. Saturated on the old benchmark, failing four out of five tasks on the new one.

Scores have climbed since. Snorkel's tracked leaderboard puts Claude Opus 5 at 31.43% binary completion and 68.31% partial at a 500-step budget, with GPT-5.6 Sol behind it at 27.34% binary and 62.72% partial. At a Snorkel reading group in early September, the OSWorld 2.0 team reported Claude Fable 5.1 — released less than a day before the talk — pushing partial scores above 60% and binary completion above 45%.

Read those two columns side by side and you get the honest picture of computer-use agents in late 2026. They make substantial progress on most real workflows. They finish somewhere between a quarter and a half of them.

A partial score of 68% is not "68% as good as a person." It means the agent hit roughly two-thirds of the checkpoints and then, most of the time, did not deliver the finished artefact.

Where each vendor actually stands

The product churn in this category has been brutal. Three of the most-covered products from 2025 no longer exist.

Anthropic

The one company that has kept a continuous line from the original 2024 beta to today. Computer use exists as an API primitive, as Claude for Chrome (a browser extension bundled with paid plans — the only product in this category with a public install figure, reported at roughly 10 million on the Chrome Web Store by June 2026, up from about 40,000 in December 2025), and inside Claude Cowork for desktop-level work.

Claude Opus 5 shipped 24 July 2026 at unchanged pricing ($5/$25 per million tokens). Anthropic's own announcement reports 70.57% on OSWorld 2.0 against 55.7% for Opus 4.8, and 26.0% on Zapier's AutomationBench against 17.4% for the much more expensive Fable 5.

Note the discrepancy: Anthropic's self-reported 70.57% sits above Snorkel's independently tracked 68.31% partial for the same model. That's a two-point gap from harness and effort configuration, not dishonesty — but it's exactly why you read the methodology column.

Anthropic is also the only vendor publishing hard adversarial numbers, which I'll come back to.

OpenAI

The most product churn of anyone. Operator launched January 2025 at $200/month on ChatGPT Pro. It folded into "ChatGPT agent" in July 2025. Then came the Atlas browser in October 2025, macOS only.

OpenAI announced Atlas's retirement on 9 July 2026. It stopped working on 9 August 2026 — less than ten months after launch. The company's own migration page says browser-based agentic work moves into ChatGPT and Codex, with a more capable browser experience built into the unified desktop app: multiple tabs, downloads, account login support.

That consolidation, reported as being driven by applications chief Fidji Simo, merged Codex into a single ChatGPT desktop app with a built-in browser and computer control. The delegation surface is now called ChatGPT Work. There is no separate "agent mode" button in the current Pro web interface.

The lesson OpenAI paid for in public: people will not move their bookmarks, passwords, extensions and habits into a new browser for an AI feature. Put the agent next to the pages they already open.

Google

Project Mariner launched December 2024 as a research prototype and was shut down on 4 May 2026, seventeen months in. Google's own farewell line said the technology moved into other products, which is accurate.

What replaced it is more useful to a builder than the prototype ever was. The Gemini Computer Use model (gemini-2.5-computer-use-preview-10-2025) is exposed through a computer_use tool in the Gemini API on AI Studio and Vertex, billed at $1.25 per million input tokens, running an observable loop: send goal plus screenshot plus action history, receive a function call, execute it via Playwright or Browserbase, screenshot again. Google says it leads on browser-control latency on the Browserbase harness for Online-Mind2Web.

On the consumer side, Chrome's auto browse requires a Google AI Pro or Ultra subscription and reached Android at OS level in late June 2026, starting with Pixel 10 and Galaxy S26. Since March 2026, Google's agent traffic identifies itself with a Google-Agent user agent string, which is the single most useful thing any vendor has done for site owners in this whole cycle.

Microsoft

The least glamorous and, for actual enterprise deployment, probably the most consequential. Computer use in Copilot Studio went generally available on 13 May 2026 across all commercial Power Platform geographies.

What you get with GA that preview didn't have: model choice across OpenAI and Anthropic, credential storage in Azure Key Vault, Purview and Dataverse audit propagation with session replay, and Windows 365 Cloud PC pools for ephemeral execution. Billing runs at 5 Copilot Credits per step, 15 on a premium model.

The catch nobody mentions in the press coverage: computer use only works for agents with generative orchestration enabled. Classic-orchestration agents need a migration first.

Microsoft is also the vendor most explicitly building for the "no API exists" case — legacy systems, vendor portals, internal tools nobody will ever expose properly. That's an unglamorous but enormous market.

Amazon

Nova Act went from research preview (March 2025) to limited preview (July 2025) to general availability on 2 December 2025 at re:Invent. Amazon's differentiator is training approach: rather than bolting a general model onto an orchestration layer, Nova Act is trained with reinforcement learning in synthetic "web gyms" that mimic real interfaces, co-training model, orchestrator, tools and SDK together.

Human-in-the-loop escalation is a first-class feature rather than a bolt-on. Nova Act also powers parts of Alexa+ when no direct API connection exists.

Perplexity and the browser crowd

Comet launched July 2025 at $200/month and went free worldwide in March 2026 on macOS, Windows, Android and iOS — including agent mode, which most rivals still gate behind a subscription. Its Background Assistant runs scheduled autonomous tasks. An April 2026 update on Mac extended the agent beyond the browser into local file editing.

Around it: Opera Neon (agent behind a paid tier), Dia from The Browser Company, now an Atlassian product, Brave Leo, Firefox's opt-in AI Window, and Edge with Copilot after Microsoft retired the "Copilot Mode" brand in May 2026.

Alibaba and the open-source tier

Qwen3.8 Max topping the OSWorld-Verified leaderboard at 86.1% is not a footnote. Qwen3.8-27B is the leading open-source entry at 84.3%. If your objection to computer-use agents is that they send screenshots of your desktop to a US cloud provider, that objection now has a self-hostable answer within a couple of points of the frontier.

The infrastructure layer

Browser Use, Browserbase Stagehand, Skyvern and BrowserOS sit underneath most of this. Independent harnesses built on them regularly beat the model vendors' own published numbers — Pointer posted 83.6% on OSWorld with Claude Opus 4.7 and 81.5% with Sonnet 4.6 in May 2026, both above the human baseline.

The scaffold is worth as many points as the model. Any comparison that treats an OSWorld score as a property of a base model is misreading it.

The comparison table

What still breaks, in the vendors' own words

The interesting thing about the OSWorld 2.0 failure analysis is that it doesn't read like a model problem. It reads like a bad-employee problem.

The authors group recurring failures into a short list. Agents lose track of constraints given at the start of a long task. They miss information that appears mid-task and never revisit it. They guess instead of asking when a requirement is ambiguous. They skip verification — they do the work and never check whether the work landed.

The weaknesses concentrate on exactly the things that require holding hidden state across hundreds of steps: implicit-state inference, tracking multiple items at once, visual-spatial precision.

The older, more familiar weak points are all still there too. Sites that actively detect and block automated browsers. CAPTCHAs, which remain a deliberate refusal rather than a capability gap. JavaScript-heavy single-page apps where the screen changes faster than the agent can re-read it. Fine motor work — precise scrolling, dragging, zooming — is flagged in current release notes, not historical ones.

There's also a domain split worth knowing if you're choosing between vendors. In the OSWorld 2.0 breakdown, Claude models do relatively better on dynamic environments and cross-source reasoning; GPT models do relatively better on multimodal editing and virtual-environment-specific tasks.

The problem nobody has solved

This is the section most vendor comparisons skip, and it should probably be the first thing anyone reads.

A computer-use agent runs inside your authenticated sessions. Your email, your bank, your admin panels, your cloud storage. It reads the page and decides what to do next. Which means text on the page can become an instruction.

That's indirect prompt injection, and it is not theoretical.

Brave's security team disclosed the first working attack against Perplexity Comet in August 2025, hiding instructions in content invisible to a human — white text on white, HTML comments — that caused the agent to perform cross-site actions including reaching into email for one-time passcodes when the user had merely asked it to summarise a page. Brave followed up in October 2025 with findings against Fellou and Opera Neon. Atlas launched that same month and researchers demonstrated injections within days, including through a shared Google Doc. Miggo Security demonstrated a semantic attack on Gemini via calendar invites in January 2026 — ordinary language that passes any content filter, harmful only once a model with tool permissions interprets it.

Then the University of Washington published the structural version of the problem.

Franzi Roesner and David Kohlbrenner's team tested seven agentic browsers — Brave Leo, ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, Edge with Copilot, Firefox AI Mode and Comet — in late January and early February 2026. Four of them created conditions for a malicious website to bypass the same-origin policy, the boundary that has kept one tab from reading another tab's data since 1995. They ran a working proof of concept against Atlas: a page embedded inside a trusted site stole data from that trusted site, the equivalent of an ad on a webmail page reaching into the inbox.

Their finding, stated plainly in the write-up: the same-origin policy is now only as strong as the agent's prompt-injection defences.

Kohlbrenner's summary was blunt. <q>Browser agents aren't ready for the public.</q> The least risky browser they tested, Firefox AI Mode, was also the most limited — which is the whole trade-off in one sentence. Agents that can do less can be tricked into less.

OpenAI's chief information security officer Dane Stuckey has publicly described prompt injection as <q>a frontier, unsolved security problem</q>. OpenAI has since compared it to scams and social engineering: a risk to be managed rather than eliminated.

The one vendor publishing numbers against this is Anthropic. On the Gray Swan indirect prompt injection benchmark, attacker success within 15 attempts fell from 5.5% on Opus 4.8 to 2.0% on Opus 5. Mythos 5 sits at 2.6%. GPT-5.6 Sol, on the same benchmark, sits at 20.0%. In browser environments run through Claude Cowork, attack success dropped from 31.5% to 3.70% with no safeguards applied, and to zero across all 129 tested environments with automatic safeguards on.

Take those as directional rather than definitive — they're vendor-run, and a 2.0% success rate within 15 attempts is still a 2.0% success rate against an attacker who can retry forever. But it's the only apples-to-apples adversarial comparison anyone has put in public, and the spread between 2.0% and 20.0% is not a rounding error.

How to read a vendor benchmark claim without getting played

Four questions, in order of how often they catch something:

1. Which benchmark, and which version? OSWorld, OSWorld-Verified and OSWorld 2.0 are three different tests. Scores are not interchangeable. OSWorld 2.0 also had 06.24 and 08.08 releases that changed things. A score without a version is not a score.

2. Binary or partial? On OSWorld 2.0 the same system can honestly be described as 68% or 31%. One means checkpoints hit, the other means the job finished. Vendors quote the first. You care about the second.

3. Whose harness? The leaderboards mix benchmark-author runs, vendor self-reports and independent third-party runs, with different step budgets, OS images and tool permissions. Pointer's independent scaffold beat the model vendors' own published numbers using the vendors' own models. A score describes a system — model plus scaffold plus policy — not a model.

4. What was excluded? Official OSWorld policy allows excluding eight Google Drive tasks. Small, but it's the kind of thing that separates a 85.6% from an 86.1%, and vendor blogs fight over that gap.

The practical read

The decision rule from the original version of this piece still holds, and has actually sharpened:

Ask whether your task fails loudly or quietly.

An agent that hits a CAPTCHA and stops has wasted five minutes. An agent that fills a form with slightly wrong data and submits it has created a problem you'll find in three weeks. Partial-credit scores in the 60s with binary completion in the 30s is precisely the profile of a system that produces plausible, incomplete, wrong-in-the-middle output.

So:

Genuinely worth deploying now. Repeatable sequences on stable, cooperative interfaces where a human sees the result before it counts. Data entry into internal tools. Invoice extraction. Dashboard checks. UI regression testing — Google is running its own computer-use model in production for exactly this. Anything where the system you're automating has no API and never will.

Deploy with real guardrails. Anything touching credentials, money or irreversible actions. Use the confirmation gates; they exist because the vendors know what happens without them. Run agents from a dedicated browser profile with no saved passwords and no banking sessions. Microsoft's audit trail, session replay and DLP integration exist because enterprise buyers demanded exactly this, and they're the right shape for a reason.

Still faster by hand. Long multi-hour professional workflows end to end. Sites actively fighting bots. Anything where a wrong-but-plausible result is expensive and nobody will check.

The gap is closing. Fifteen percent to eighty-six percent on the same benchmark family in under two years is not hype, it's a trend line. But the field responded to saturation by building a harder test, and on that test the best system in the world finishes under a third of the work. Both things are true at once.

Treat these as a very fast junior who never asks for clarification and never checks their own work. That framing will serve you better than any benchmark score for at least another year.

What to watch next