Computer-Use Agents Enter Production: What Actually Works in the Enterprise

Computer-use AI agents operate software the way people do: by seeing the screen and driving mouse and keyboard actions across apps and browsers.

Two years after frontier labs first shipped screenshot-to-action loops, computer use AI agents are no longer only research demos. Vendors expose computer-control tools in APIs and desktop products; enterprises are piloting them against legacy GUIs that never got a clean API. The harder question is not whether an agent can click a button. It is whether AI agent production survives contact with real workflows, token budgets, and risk teams.

This article separates what public benchmarks now measure from what reliably pays off on the enterprise desktop—and where the capability cliff still decides the roadmap.

What “computer use” means in practice

A computer-use agent observes a graphical interface (typically via screenshots, sometimes with accessibility or DOM side channels) and emits low-level actions: move, click, type, scroll, drag, wait. Unlike a classic RPA script pinned to selectors, the agent re-plans from visual state. That flexibility is why teams reach for these systems when the target is a vendor portal, a thick client, or a mash-up of browser and desktop apps that no integration project ever finished.

Anthropic’s own product guidance is frank about maturity: computer use remains early relative to Claude’s coding and text strengths; the agent can make mistakes; users should start with trusted apps and avoid sensitive data; some apps stay off-limits by default; and the system requests permission before opening new applications while scanning for prompt-injection patterns. That framing—useful, supervised, not yet a silent autopilot—is the right mental model for enterprise AI agents that touch production systems.

The architectural bet is portable: treat the screen as a universal I/O surface. The operational bet is narrower: put the loop inside a sandbox you control, gate irreversible steps, and measure outcomes in the system of record—not in the agent’s self-report.

Benchmarks: short tasks climbed; long workflows did not

From OSWorld 1.0 to OSWorld 2.0

The original OSWorld suite put multimodal agents into real Ubuntu, Windows, and macOS environments with hundreds of open-ended desktop and web tasks. At publication, humans completed more than 72% of tasks while the best evaluated model sat near 12%. That gap defined the first generation of computer-use research: agents struggled with GUI grounding and operational knowledge even on comparatively short interactions.

By mid-2026, the field had a more revealing yardstick. OSWorld 2.0 replaces many single-shot tasks with 108 long-horizon workflows. Skilled humans need a median of about 1.6 hours per task; roughly 70% of tasks take more than an hour. Frontier agents burn on the order of 318 tool calls on a demanding Claude Opus configuration, versus about 30 in OSWorld 1.0. Tasks are grounded in authentic artifacts and stateful user profiles, and the suite includes separate safety audits for sensitive execution.

Under the primary binary-completion metric at a 500-step cap, the strongest reported configuration—Claude Opus 4.8 with maximum thinking and batched tool calls—still finishes only 20.6% of tasks, with a 54.8% partial-credit score. A more token-efficient competitor (GPT-5.5 in the published comparison) plateaus near 14% binary completion. Failure modes shift away from “cannot click” toward “loses constraints,” “misses mid-task information,” “guesses instead of asking,” and “skips verification,” especially when required state is hidden.

Token economics are now part of the benchmark story, not a footnote. In OSWorld 2.0’s reported frontier, GPT-5.5 reaches about 14% binary reward with roughly 39K output tokens, while Claude Opus 4.7 climbs to 18.2% around 150K tokens and Opus 4.8 to 20.6% around 244K. Higher completion is available—but at a steep marginal cost. Horizon length compounds the problem: binary completion is already weak on sub-hour tasks and falls toward zero once workflows stretch past roughly two and a half hours in the published bins.

WebArena and the browser slice

WebArena remains the reference for realistic, self-hosted multi-site web work (e-commerce, forums, collaborative software, CMS). In the original paper, the best GPT-4 agent reached 14.41% end-to-end success against a human baseline of 78.24% on sampled template tasks. Community leaderboards have moved since then, but the original lesson still holds for production planning: browser autonomy is a different product surface from reliable business completion, and evaluation harnesses matter as much as model names.

The enterprise cliff: UI-CUBE

Academic desktop and web scores can look encouraging while enterprise readiness stays thin. UiPath’s UI-CUBE benchmark was built explicitly for that gap: 226 tasks across simple UI interactions (136) and complex workflows (90, including copy-paste/business-process and mocked enterprise apps such as CRM, ERP, expense, HR, and project boards), with multi-resolution testing and programmatic checks against application state.

Results show a capability cliff, not a smooth curve. Averaged across resolutions, evaluated systems reach roughly 67–85% success on simple interactions (humans: 97.9%) but only 9–19% on complex workflows. Humans without prior app experience still achieve only 61.2% on those complex tasks—an important ceiling for anyone comparing agents to “what a person would do on day one.” Relative to humans, agents reach about 68–87% of human performance on simple work but only 15–32% on complex workflows. Resolution amplifies brittleness: several models lose tens of percentage points on simple tasks when moving from XGA to 4K, as grounding errors rise with a larger pixel action space.

UI-CUBE’s authors argue the discontinuity points to architectural limits in memory, hierarchical planning, and state coordination—limits that prompting alone will not erase. Their practical recommendation matches what production teams already rediscover: decompose complex processes into atomic steps current models can handle, rather than hoping one long trajectory will hold.

Silent failures beat flashy demos

Enterprise software fails differently from consumer demos. ERPBench evaluates screenshot-only agents against a live, reproducible ERP and grades tasks against database ground truth, not screenshots alone. The paper’s central warning: strong general GUI performance does not transfer to enterprise reliability. Agents may navigate to the right record and even press save while writing the wrong value. In one reported pattern, an open model reached the target in most runs and committed a save in a large share of them, yet left the correct database value in only a few percent of cases—so nearly every save was a silent corruption risk.

That class of error is invisible to “did the agent look busy?” metrics and devastating to finance, inventory, and HR systems. For AI agent production, success criteria must live in the system of record: field-level assertions, idempotent writes, and human approval before irreversible commits.

Token cost is not the full bill—but it already shapes design

Computer-use loops are screenshot-heavy. Every observation can send a large multimodal payload; every recovery after a mis-click burns another turn. OSWorld 2.0’s token-versus-score frontier shows why finance teams care: pushing a few more completion points can multiply output tokens several times over. Meanwhile, agents often take more steps than people for the same task—efficiency studies cited alongside OSWorld report roughly 1.4–2.7× human step counts for leading agents—so latency and cost scale with thrashing, not only with model price cards.

A useful production heuristic follows from the evidence, without inventing ROI theater:

1. Prefer APIs and connectors when they exist. Anthropic’s product stack itself prioritizes precise connectors before falling back to screen control.
2. Bound the horizon. Tasks that fit inside a few dozen reliable actions are candidates; hour-scale, multi-app odysseys are research.
3. Budget for partial automation. Pair the agent with deterministic validators and human review on money movement, identity changes, and external messages.
4. Measure cost per verified outcome, not per token or per demo. A cheap trajectory that writes wrong ERP data is infinitely expensive.

Reliability and security limits that decide go-live

Computer-use agents inherit every classic automation risk, then add model-specific ones:

• Prompt injection via the screen. Untrusted page content, emails, and documents can instruct the agent. Vendor classifiers help; they are not a substitute for network allowlists and action allowlists at the execution layer.
• Credential and data exfiltration. Screenshots may contain secrets. Redaction before inference and least-privilege service accounts are baseline controls.
• Environment persistence. Shared desktops accumulate cookies and files. Ephemeral containers or VMs per run shrink blast radius.
• Irreversible actions. Purchases, deletions, wire instructions, and production deploys need explicit human gates—the same posture Anthropic recommends when consequential actions appear.
• Auditability. Log observations, actions, approvals, and postconditions in your control plane. Do not depend solely on a vendor chat transcript.

What actually works in the enterprise today

Synthesizing benchmarks and vendor guidance, the working pattern for computer use AI agents in 2026 looks like this:

High fit (ship with guardrails)

• Atomic UI chores inside known apps: open a form, fill fields from a structured payload, download a file, export a report, click through a fixed wizard.
• Browser tasks with clear postconditions on allowlisted domains, especially when a Playwright or API path can take over after navigation.
• Developer and analyst assistants that drive IDEs, terminals, and internal tools under supervision—where mistakes are reversible and review is natural.
• Human-in-the-loop dispatch: the agent prepares; a person approves the commit.

Medium fit (pilot narrowly)

• Multi-step copy-paste across two or three familiar systems with programmatic verification after each hop.
• Exception handling on top of existing RPA: the agent proposes a recovery path; automation or a human executes it.
• Read-mostly reconnaissance (gather status, screenshot evidence, draft a ticket) without write access to systems of record.

Low fit (keep in the lab)

• Unattended, hour-scale workflows spanning email, banking portals, CAD, and legacy ERPs without intermediate checkpoints—precisely where OSWorld 2.0 and UI-CUBE show collapse.
• Any process where a wrong save is worse than no save (core ERP master data, payroll, clinical records) unless database-level oracles and mandatory approvals are in place.
• “Replace the shared-services team” programs sold on short-task leaderboard screenshots.

The strategic implication for platforms and “AI power players” is convergence, not a single winner: portable screenshot agents, browser-native automation, and code-driven control (Playwright-style) will coexist. Enterprises that win will route each workflow to the cheapest reliable substrate—API first, structured browser automation second, full computer use last—and will build evaluation suites that look more like UI-CUBE and ERPBench than like marketing demos.

A practical production checklist

1. Define the outcome in data, not in UI narratives. Prefer state diffs and database checks.
2. Cap steps, time, and domains. Kill switches beat infinite retry loops.
3. Decompose long processes into agent-sized units with checkpoints and partial credit in your own harness.
4. Separate navigate / enter / commit stages in metrics so silent wrong-writes cannot hide behind “reached the form.”
5. Price the full loop: tokens, sandbox compute, reviewer time, and rework.
6. Threat-model the screen as an untrusted channel.
7. Re-run benchmarks on your apps at your resolutions; published OSWorld or WebArena scores are screens, not certificates.

Bottom line

Computer-use agents have entered the enterprise toolkit. On short, well-scoped UI work they are increasingly competent; on long, stateful, multi-app business processes, public evidence—from OSWorld 2.0’s ~21% binary completion ceiling to UI-CUBE’s single-digit-to-low-teens complex-task rates and ERPBench’s wrong-save failures—says they are not yet dependable autopilots.

What works today is disciplined partial autonomy: enterprise AI agents that click where APIs are missing, stop where risk begins, and prove success in the ledger. Treat leaderboard climbs as research signal. Treat production as a systems problem—evaluation, sandboxing, cost, and governance—wrapped around a still-maturing model skill.

Related reading

• Open-Weight Frontier Models vs Closed APIs: The Sovereignty Trade-Off
• From Chatbots to Work OS: How AI Assistants Are Swallowing Enterprise SaaS
• Browser, IDE, and OS: The Three Battlegrounds for AI Interfaces

Images: original illustrations generated for AndBeyond.Tech; no logos or real people depicted.