What can AI agents that use a computer really do in 2026?

A computer-use agent is a language model that works a computer the way you do: it receives a screenshot, decides where to click or what to type, sends that action, gets a new screenshot and repeats. It needs no special connection to the app it is using. If a person can do it with a mouse and keyboard, the agent can at least try.

That idea is two years old now. What has changed by October 2026 is less the basic loop than everything around it: agents act faster, can send several actions in one go, can zoom in on small text, and come with built-in defenses against hostile web content. The honest summary is that they handle routine, well-described tasks and still need supervision for anything that costs money, sends a message or touches private data.

What the agent actually does

Anthropic's current computer use tool for Claude gives the model a set of 17 actions, including taking a screenshot, clicking, typing and zooming. Your own program runs those actions on a machine you control, usually a virtual machine or a container. The model can now send a batch of several actions in one turn, for example click a field, type a name, press Tab, type a date, which makes it quicker but also means a whole step can happen before anyone looks.

For jobs that never leave the web browser, Anthropic now points developers to a separate browser tool that reads and acts on the page itself rather than on pixels. That is a useful rule for anyone choosing a product too: if the task lives entirely in web pages, a browser agent is usually simpler and more reliable than one driving a full desktop.

Good fits today:

• copying data between two apps that have no integration, such as a spreadsheet and an old web form;
• collecting the same few facts from several web pages into a table;
• clicking through a web app to check that a new feature works, the way a tester would;
• slow background chores where nobody is waiting for the result.

How good are they, measured?

The standard yardstick is OSWorld, a benchmark of 369 real tasks in real operating systems, each checked by a script. When it was first published, people completed about 72% of the tasks and the best model only about 12%. In January 2025, OpenAI reported 38.1% for the agent behind Operator. The benchmark was cleaned up and relaunched as OSWorld-Verified in July 2025, and its maintainers now run the leaderboard submissions themselves, so scores reported since then are more comparable than older ones.

Two cautions when you read a vendor's number. First, a benchmark task is short and precisely worded; your task probably isn't. Second, a single success rate hides which tasks fail. An agent that gets 70% of benchmark tasks right can still fail every time on the one form your office uses. The only score that matters to you is the one you measure on your own work.

A worked example: a supervised data-entry job

Say you need 40 supplier records copied from a spreadsheet into a web portal with no import button. Here is a setup a careful beginner could follow with any computer-use product.

1. Isolate it. Run the agent in its own virtual machine or a separate browser profile with no saved passwords, no email and no other tabs.
2. Narrow the web. If the product allows it, limit the agent to the portal's domain.
3. Start with three records, not 40, and watch.
4. Ask it to check its own steps, using a prompt like the one below.
5. Review the log of actions and compare three records by hand before letting it continue.

You will copy supplier records from the open spreadsheet into the supplier portal, one row at a time.
Only use the portal at the address already open. Do not open other sites.
After each record, take a screenshot and say in one sentence what it shows and whether the record saved correctly. If it did not, stop and tell me.
Do not click "Submit batch", "Delete" or anything that sends email. When the three test rows are done, stop and wait for me.

The line about screenshots comes straight from a known weakness: Anthropic's documentation notes that the model sometimes acts as if a step worked without looking, and recommends asking it to confirm each result from a fresh screenshot.

Where do they still fail, and how do you supervise them?

Anthropic lists the weak spots plainly. Agents are slower than a person. They misjudge where to click, choose the wrong action, scroll unreliably, struggle with spreadsheets and with niche apps, and do worse when a task spans several programs. Long tasks magnify all of this, because one wrong click early can send everything after it down the wrong path.

The most serious failure is not clumsiness but being misled. An agent reads everything on screen, and a web page, email or image can contain text that tries to give it new orders. Claude now runs classifiers that look for these hidden instructions in screenshots and make the model ask you before acting, and other vendors have similar checks, but none of them claims to be complete. Treat every page the agent visits as a possible source of such traps.

Supervision, then, comes down to four habits drawn from the vendors' own guidance:

Add one more of your own: keep the action log and read it. When a task fails the same way twice, rewrite the instructions rather than retrying. And when a task needs perfect precision, such as payroll or anything legal, keep the agent to preparing a draft that a person completes.