Agentic Computer Use: The Ultimate 2026 Guide

The definitive July 2026 guide to AI agents that operate computers: benchmarks, browsers, pricing, law, security, and the platforms that actually work.

In October 2024, the best AI model in the world completed 14.9% of real desktop tasks on the OSWorld benchmark. By June 2026, frontier models score above 85%, beating the 72.36% human baseline on the same test. That is not incremental progress. That is a capability class going from lab curiosity to something that outperforms the average human office worker at operating unfamiliar software, in roughly 20 months.

Agentic computer use refers to AI agents that actively operate computers rather than just chat or make suggestions. These systems perceive on-screen interfaces (windows, buttons, web pages) and act by moving the mouse, typing, clicking links, filling forms, and chaining those actions into complete workflows. They use the computer the way a human would, which means they work with any software, even applications that were never designed for automation and expose no API.

When we first published this guide in late 2025, the field was young: OpenAI's Operator was the flagship, Google's Project Mariner was the future, and the top benchmark scores looked embarrassing next to human performance. Every one of those anchor points is now obsolete. Operator no longer exists as a standalone product, Project Mariner was discontinued in May 2026, and computer use stopped being a separate research-preview feature and became a native capability of frontier models. This refresh rewrites the guide from the ground up with the July 2026 state of the field, and keeps the original 2025 numbers where they are useful, because the distance between then and now is itself the most important fact about this industry.

This guide covers what agentic computer use means today, the architectural split between OS-level agents, browser agents, and agentic browsers, an updated top 10 ranking of the leading platforms, the benchmark collapse story, the browser wars, the first CFAA legal precedent for agentic commerce, in-the-wild prompt injection attacks, July 2026 pricing across every major provider, and an honest assessment of where this technology still fails.

Contents

1. Understanding Agentic Computer Use: what it is and why it matters
2. The Benchmark Collapse: from 14.9% to 85% in 20 months
3. OS-Level, Browser-Based, and the New Architectural Split
4. Top 10 AI Computer Use Agents in 2026: profiles and pricing
5. The Browser Wars: Atlas vs Comet vs Claude for Chrome vs Fellou
6. Native Computer Use in the Model Layer: the death of the standalone CUA model
7. Key Use Cases and Applications: what people actually automate
8. Security in the Wild: prompt injection left the lab
9. The Law Arrived: Amazon v. Perplexity and agentic commerce
10. Consolidation and Casualties: who lived, who died since 2025
11. Platforms, Pricing and the July 2026 Buyer's Guide
12. The Open-Source Stack in 2026
13. Windows as an Agent Platform and the MCP Standards Layer
14. Reality Check and Future Outlook

The 2026 Assessment: Every Major Computer Use Agent, Scored

Before the detailed profiles, here is the master comparison. Each platform is scored 0-10 on four criteria. Task Capability (30%) measures published benchmark performance and breadth of what the agent can operate. Cost and Access (25%) measures real pricing and how easy it is to actually get. Reliability and Safety (25%) covers guardrails, injection defenses, and production trust. Ecosystem and Openness (20%) covers integrations, standards support, and developer gravity. The final score is the weighted average, and the table is sorted by it.

Two notes on reading this table honestly. First, the gap between #1 and #11 is much smaller than it was in 2025: the floor rose faster than the ceiling, and every platform here would have topped the 2025 edition of this ranking. Second, capability scores lean on public benchmarks (OSWorld-Verified and Online-Mind2Web) which measure different things: OSWorld tests full desktop operation, Online-Mind2Web tests live websites. A platform can be excellent at one and mediocre at the other, and the profiles below spell out which is which. We maintain a standalone deep ranking in our computer use benchmarks report if you want the full methodology.

1. Understanding Agentic Computer Use

Agentic computer use (often called computer-use agents or CUAs) describes AI systems that do not just generate text but actively perform tasks on a computer on your behalf. These agents see the same graphical user interfaces we do (web pages, app windows, buttons, menus) and interact with them by clicking, typing, and scrolling. The core loop is simple to state and brutally hard to engineer: take a screenshot, decide the next action, execute it, observe the result, repeat until the task is done or something goes wrong.

The reason this matters is structural, not cosmetic. The world's software was built for human eyes and hands. Decades of business logic live inside applications that expose no API: legacy ERP screens, government portals, supplier dashboards, internal admin tools. Traditional automation (RPA) attacked this with brittle pixel-position scripts that shattered whenever a button moved. A computer-use agent replaces the brittle script with a vision-language model that understands what a screen means, so when the button moves, the agent finds it anyway. That single property, robustness to interface change, is why enterprises that spent a decade fighting RPA maintenance costs are paying attention, a shift we unpacked in our guide to agentic business process automation.

What changed between 2024 and 2026 is that this went from barely working to working most of the time. In 2024, computer use was a demo: impressive on video, unusable in production. Through 2025, task success rates on hard benchmarks roughly quadrupled. By mid-2026, frontier models complete more than 8 in 10 realistic desktop tasks unassisted, and specialist agents on live websites exceed 9 in 10. The rest of this guide is about what that means in practice: which agents to use, what they cost, where they fail, and what happens legally and security-wise when software starts using software.

One definitional boundary is worth drawing early. Computer use is one tool among several that a modern agent holds. When an agent can call a clean API or an MCP server, it should: APIs are faster, cheaper, and deterministic. Pixel-level control is the fallback of last resort for the enormous surface of software that has no machine interface. The best platforms in 2026 route between these modes automatically, and section 14 gives you a decision framework for choosing between them.

2. The Benchmark Collapse: From 14.9% to 85% in 20 Months

No single dataset tells the story of this field better than OSWorld. It is a benchmark of 369 real desktop tasks across Ubuntu, Windows, and macOS: editing spreadsheets, configuring applications, manipulating files, multi-app workflows. Crucially, it publishes a human baseline of 72.36%, because even humans fail a quarter of these tasks under test conditions - OSWorld. When the original edition of this guide went out, the headline number was that Anthropic's October 2024 computer use beta (running on the long-retired Claude 3.5 Sonnet, cited here strictly as history) scored 14.9%, nearly double the 7.8% next-best system. We called that state of the art with a straight face, because it was.

Here is what the same leaderboard looks like now. As of June 2026, Claude Mythos Preview leads OSWorld-Verified at 85.4%, with Claude Fable 5 and Claude Mythos 5 at 85.0%, Claude Opus 4.8 at 83.4%, Claude Sonnet 5 at 81.2%, and GPT-5.4 at 75.0% - Steel OSWorld leaderboard. Early 2024 baselines on the same benchmark sat around 12%. The frontier crossed the 72.36% human baseline in early 2026 and kept going. A benchmark designed to humble AI systems is now approaching saturation, and researchers already treat OSWorld the way they treat solved benchmarks: as a regression test, not a differentiator.

Because OSWorld is saturating, the competitive action moved to live-web benchmarks, where real websites change under the agent and nothing is cached or sanitized. The reference test in 2026 is Online-Mind2Web, and its leaderboard (updated June 29, 2026) is genuinely surprising: the leader is not a trillion-dollar lab but Browser Use, whose bu-max cloud agent scores 97.0% using an Auto-Research technique - Browser Use. Behind it sit GPT-5.4 Native Computer Use at 93.0%, ABP + Claude Opus 4.6 at 90.53%, TinyFish at 90.0%, and UI-TARS-2 at 88.2%, while first-party consumer agent modes trail badly: ChatGPT Atlas Agent Mode at 71.0% and the older Gemini 2.5 Computer Use at 69.0% - Steel Online-Mind2Web leaderboard. The old edition's claim that a ~70% Online-Mind2Web score was near-SOTA is now literally the bottom of the leaderboard.

To make the shift concrete, here is a then-vs-now table built from claims the original edition of this article actually made, set against the verified July 2026 state. Few competitors can publish this table, because few of them wrote their 2025 numbers down.

The first-principles lesson in this table is about the pace of obsolescence itself. Any capability claim in agentic AI has a half-life of roughly one quarter. Vendors, buyers, and writers who anchor on a six-month-old number are not slightly wrong, they are wrong by the entire useful range of the metric. That is why every pricing and benchmark figure in this refresh carries a date. For a deeper treatment of how the current generation performs beyond computer use, see our model benchmarks and pricing snapshot and the newer Fable 5 and Mythos 5 benchmark breakdown.

A third benchmark family deserves a mention because it points at the next frontier: AndroidWorld, which tests agents on live mobile apps rather than desktops or websites. Mobile is where consumer attention actually lives, and it is a harder perception problem (denser layouts, gesture navigation, aggressive interstitials) with a thinner automation history, since mobile operating systems never accumulated the accessibility tooling desktops did. Google's push to bring Chrome+Gemini auto-browse to 200 million Android devices makes AndroidWorld scores a leading indicator for whether agentic behavior survives contact with the small screen, and it is the leaderboard we expect to be quoting at the top of the next refresh of this guide.

There is one more honest caveat: benchmark saturation does not equal task saturation. OSWorld tasks average a few minutes of human effort. Long-horizon work (a full day of bookkeeping, an end-to-end recruiting pipeline) still compounds errors step by step, and an agent that is 85% reliable per task can be far less reliable across a 40-task chain. The benchmark collapse is real progress, but section 14 explains why serious deployments still design for checkpoints and human review rather than fire-and-forget autonomy.

3. OS-Level, Browser-Based, and the New Architectural Split

The original edition of this guide drew one line: OS-level agents (which control an entire desktop through screenshots and synthetic mouse/keyboard events) versus browser-based agents (which operate inside a web browser, often reading the DOM directly instead of pixels). That distinction still matters, because it drives capability and risk in opposite directions. An OS-level agent can operate anything with a screen, including that 2009 ERP client your finance team refuses to give up, but it needs a sandboxed machine and carries a wider blast radius. A browser agent only reaches the web, but the web is where most business workflows live, and DOM access makes browser agents faster and cheaper than pixel-parsing.

What 2026 added is a second split within the browser category, and it turned out to be the strategically decisive one. There are now three distinct ways to ship a browser agent, and each embodies a different bet about trust. The extension model (Claude for Chrome, Chrome's own Gemini auto-browse) puts the agent inside the browser you already use, inheriting your sessions and logins. The standalone fork model (ChatGPT Atlas, Perplexity Comet, Fellou) ships an entire Chromium-based browser with the agent woven into its core, giving the vendor full control of the surface. The separated model (Browser Use cloud, Amazon Nova Act, O-mega's virtual browser sessions, Anthropic's computer-use API against a sandboxed VM) runs the browser somewhere else entirely, so the agent never touches your personal machine or your cookies at all.

The trust trade-off is not academic. An extension agent acting inside your logged-in browser can do anything you can do, which is exactly why Anthropic spent months on adversarial testing before widening access (section 8 has the numbers). A separated agent, by contrast, starts from zero ambient authority: it only holds the credentials you explicitly give it, and a compromised session cannot leak your personal cookie jar. This is why most enterprise deployments in 2026 default to the separated model, a pattern we described in our review of stealth and managed browser infrastructure.

For buyers, the practical question is no longer "OS or browser" but "whose machine does the agent run on, and what does it inherit?" If the answer is "your machine, everything," you get maximum convenience for personal use and maximum risk for business use. If the answer is "a sandbox, nothing," you get auditability and isolation at the cost of re-authenticating services. The top 10 profiles below flag which model each platform uses, because it is now the single most consequential design choice in the category.

4. Top 10 AI Computer Use Agents in 2026

The 2025 edition of this list included Operator, Project Mariner, and Agent S2. None of those exist in that form anymore, which tells you how violent the churn has been; our archived 2025 top 10 review is a useful time capsule of how the field looked before consolidation. The profiles below follow the assessment table order and give you what the table cells cannot: context, trade-offs, and what each platform is genuinely best at.

A quick note on method before the profiles. Rankings in this category age in weeks, so we anchor every claim to a dated, linkable source and re-rank on refresh rather than pretending the order is stable. Where a vendor's own claim could not be verified by a third party, we say so. And where a platform is strong on one benchmark family but weak on another, the profile says which, because "best agent" is meaningless without "at what."

4.1 Anthropic Claude: the frontier stack, top to bottom

Anthropic in mid-2026 owns the top four slots on OSWorld-Verified, with Claude Mythos Preview at 85.4% and Claude Fable 5 at 85.0% - Steel leaderboard. The current lineup is Claude Opus 4.8 (released May 28, 2026 at $5/$25 per million tokens with a 1M-token context window and an 83.4% OSWorld score), Claude Sonnet 5 (81.2% OSWorld at intro pricing of $2/$10), and the frontier Claude Fable 5, generally available since June 9, 2026 at $10/$50 per MTok - Anthropic. Mythos 5 remains invitation-only under Project Glasswing; our Mythos Preview insider guide covers what is known.

What makes Anthropic's position unusual is that the model capability ships through three distinct products. Developers get the computer use tool in the API, still formally beta and gated by the computer-use-2025-11-24 header for Sonnet 5, Opus 4.8/4.7/4.6, Sonnet 4.6, and Opus 4.5 - Anthropic docs. Consumers get Claude for Chrome, which went from a 1,000-user research preview in August 2025 to Max users in November, then to Pro, Team, and Enterprise plans on December 18, 2025 - Claude blog. And knowledge workers get Claude Cowork, Anthropic's agentic work product, which expanded from desktop to mobile and web on July 7, 2026; we track its pricing and ecosystem in our Cowork guide. Best for: teams that want the highest desktop task reliability and the most mature safety story, and are willing to pay frontier prices for it.

4.2 Browser Use: the open-source outsider that took the record

Browser Use is the clearest evidence that specialist agents beat generalist modes on live-web work. Its cloud agent bu-max posted 97.0% on Online-Mind2Web in March 2026, the highest score ever recorded on that benchmark, using an Auto-Research technique that has the agent study a site's structure before committing to actions - Browser Use. The open-source framework underneath is a Python library that fuses DOM analysis with vision, which lets it act on element structure when available and fall back to pixels when it is not.

The trade-off profile is classic open source. You get state-of-the-art capability, full transparency, and a free self-hosted path, but guardrails, credential hygiene, and monitoring are your job unless you pay for the managed cloud. There is no enterprise compliance department to call. For engineering teams automating web workflows at scale, Browser Use is in 2026 the default first evaluation, and it earned that position in open competition; our top 10 browser agents review benchmarks it against the field in more depth. Best for: technical teams that want maximum live-web success rates and control of their own stack.

4.3 OpenAI: from Operator to ChatGPT Agent and Atlas

OpenAI's journey through this category is the story of a product category dissolving into a platform. Operator, the standalone January 2025 research preview our original article profiled at length (32.6% success on 50-step tasks), was folded into ChatGPT Agent in July 2025. Computer use then went native in the model line: GPT-5.4 was the first general model with native computer use, scoring 93.0% on Online-Mind2Web in that mode at $2.50/$15 per 1M tokens, and GPT-5.5 (April 24, 2026, $5.00/$30.00 per 1M with roughly a 1M-token window) posts 78.7% on OSWorld-Verified by OpenAI's own reporting - OpenAI pricing. The GPT-5.6 Sol, Terra, and Luna variants entered limited preview on June 27, 2026; our GPT-5.6 benchmark and pricing breakdown tracks them as they harden.

The consumer expression is ChatGPT Atlas, the Chromium-based agentic browser launched in October 2025, macOS-first, with agent mode gated to Plus ($20/mo) and Pro ($200/mo) subscribers - agentic browser landscape. The honest wrinkle: Atlas Agent Mode scores only 71.0% on Online-Mind2Web, far below OpenAI's own API-level 93%, a gap that reflects the consumer product's heavier guardrails and its younger orchestration layer. Best for: teams already on the OpenAI stack that want one vendor across chat, agents, and browsing, and consumers who want an agentic browser with a familiar brand. For historical pricing context on the Operator era, our Operator pricing guide remains a reference.

4.4 Google Gemini: Mariner is dead, long live native computer use

Google's section of the 2025 edition was anchored on Project Mariner, the agent that lived in a Chrome sidebar. Mariner was discontinued on May 4, 2026, its lineage absorbed into the Gemini API - Wikipedia. The replacement strategy is native: computer use is built into Gemini 3.5 Flash (announced June 24, 2026), available through the Gemini API and the Gemini Enterprise Agent Platform, and it ships with prompt-injection auto-stop safeguards that halt execution when manipulation is detected - Google blog. This followed the Gemini 3.1 Pro (February 19, 2026) and Gemini 3.5 Flash (May 19, 2026) model releases, and it replaces the older Gemini 2.5 Computer Use whose 69% Online-Mind2Web score now props up the bottom of the leaderboard.

Google's real ace is distribution. Chrome+Gemini auto-browse is expanding to Android with a target of 200 million devices by end of 2026, which would make Chrome's roughly 3 billion users the largest agentic-browser deployment surface in existence - landscape guide. The strategic read from first principles: Google does not need the best agent, it needs a good-enough agent everywhere, because defaults beat downloads at consumer scale. Best for: consumers inside the Google ecosystem, and developers who want cheap Flash-tier computer use with built-in safety stops. Our original Mariner launch coverage documents where this started.

4.5 Microsoft Copilot: the operating system becomes the agent platform

Microsoft's bet is that the durable place to put an agent is not a browser or a chatbot but the operating system itself. Since Ignite 2025, the pieces have landed in sequence: Copilot Actions and Agent Workspace rolled out to Windows Insiders with contained, low-privilege agent accounts (agents run as separate identities with scoped permissions, not as you), Copilot Studio computer-using agents hit general availability on May 26, 2026 with secure credential management and workflow embedding - Microsoft. At Build 2026, Microsoft open-sourced the Windows Agent Framework, and Agent 365 ships standard in the October 2026 Windows release.

The enterprise logic is straightforward: Microsoft already owns identity (Entra), device management (Intune), and the desktop itself, so giving agents first-class OS accounts with audit trails slots into governance machinery that CISOs already run. The weakness is the same as every Microsoft platform story: licensing complexity, and agents that are better at Microsoft's stack than the open web. Best for: enterprises that need UI automation over legacy Windows applications with real access controls, and organizations already paying for Microsoft 365. Section 13 covers the Windows agent architecture in detail.

4.6 ByteDance UI-TARS-2: open weights at near-frontier capability

UI-TARS is ByteDance's open-source GUI agent stack, and it has quietly become the most-starred computer use project on GitHub at 37.8k stars - GitHub. The current generation, UI-TARS-2, scores 88.2% on Online-Mind2Web, which puts an openly available model within five points of the closed-weights record. The stack spans Agent TARS (a CLI and web UI for browser-centric work) and a desktop application for full GUI control, driven by ByteDance's Seed-VL vision-language models.

The significance is structural: UI-TARS-2 proves that frontier-adjacent computer use is no longer a lab monopoly. Any team willing to run its own inference can field an agent that beats ChatGPT Atlas's consumer mode by 17 points on live-web tasks. The costs are the usual ones: you bring your own guardrails, your own injection defenses, and your own compliance narrative, and for Western enterprises the ByteDance provenance is itself a procurement conversation. Best for: research teams, cost-sensitive builders at scale, and anyone who needs auditable open weights rather than a closed API.

4.7 O-mega: the managed AI workforce approach

O-mega takes a different slice of the problem: instead of shipping a model or a browser, it ships a managed AI workforce. Agents get virtual browser and computer sessions that run in isolated cloud environments (the separated architecture from section 3), a skill library of proven procedures they can discover and execute, and an orchestration layer that routes work between browser automation, computer sessions, and plain API/MCP calls depending on what the task needs. The pitch is that most businesses do not want to operate agent infrastructure any more than they want to rack servers.

The honest trade-off: a managed platform will never give you the raw configurability of a self-hosted Browser Use deployment or the OS depth of a Windows Agent Workspace. What it gives you instead is zero infrastructure, human-in-the-loop controls, and agents that persist as named workers with memory rather than one-off scripts. Best for: non-technical teams and lean operations that want outcomes (research done, forms filed, listings updated) without building an agent stack first.

4.8 Amazon Nova Act: reliability as the product

Amazon's entry took the least glamorous and possibly most commercial path. Nova Act reached general availability on December 2, 2025 as a full AWS service (us-east-1), powered by a custom Nova 2 Lite model trained with reinforcement learning in synthetic "web gyms," and it claims over 90% task reliability at scale - AWS. The design philosophy is atomic: developers decompose workflows into small, verifiable actions rather than handing the agent a vague goal, which trades autonomy for repeatability, exactly what production automation wants.

Nova Act will not top open-ended benchmarks, and that is the point. Amazon is selling boring reliability to AWS customers who need the same 40-step workflow to succeed every night, not a demo that dazzles once. It has come a long way from the Nova family's original multimodal launch. Best for: engineering teams on AWS automating defined, repeated UI workflows where a failed run costs real money.

4.9 Manus: still autonomous, newly independent

Manus remains the reference for fully autonomous cloud agents: give it a goal, and it plans, browses, codes, and delivers from its own virtual machine. The business has scaled dramatically since our 2025 profile: Sacra estimates $450M annualized revenue by June 2026, up from $127M in 2025 - Sacra. Current pricing is Free (300 daily credits), Standard $20/mo (4,000 credits), Customizable $40/mo (8,000 credits), and Extended $200/mo (40,000 credits), with annual billing saving 17% - pricing overview. Every number in our old profile (Free 1 task/day, $39 Starter, $199 Pro) is obsolete.

The bigger story is geopolitical. Meta announced a roughly $2B acquisition of Manus in December 2025; Chinese regulators blocked it in late April 2026 on national security grounds, and Meta completed an operational split from Manus by June 11, 2026, with a Chinese investor buyback underway. That saga (covered in section 10) leaves Manus independent, well-funded by revenue, and carrying regulatory overhang in both directions. Best for: individuals and teams that want goal-in, deliverable-out autonomy for research, documents, and web tasks, and can tolerate cloud execution of sensitive work.

4.10 Simular Agent S3: the research frontier you can run

Simular's Agent S series has been the academic pace-setter for desktop agents, and Agent S3 (announced October 2, 2025) is the current iteration: 62.6% on OSWorld single-run, rising to 69.9% with its Behavior Best-of-N technique, which runs multiple behavior candidates and selects the best - Simular. Simular now reports 72.6%, which crosses the ~72% human baseline, making Agent S3 the first open framework to claim superhuman OSWorld performance.

Best-of-N matters beyond the leaderboard because it previews how production agents will buy reliability with compute: run several attempts, verify, keep the winner. The framework is free and model-agnostic, but it is research-grade software: you assemble the guardrails, the sandboxing, and the ops. Best for: teams building custom desktop agents who want the strongest open scaffolding and are comfortable living close to the research.

4.11 Perplexity Comet: the free agentic browser with a legal cloud

Comet went from invite-only Max exclusive to free for all users in October 2025 and completed its cross-platform rollout with iOS in March 2026 - landscape guide. As a browser it is genuinely pleasant: an assistant in every tab, background tasks, and a shopping agent that can search, compare, and buy. As an agent it is mid-pack on benchmarks, and as a business it now operates under the shadow of Amazon v. Perplexity (section 9), where a federal court preliminarily enjoined its shopping agent from accessing Amazon in March 2026 before the Ninth Circuit stayed enforcement pending appeal.

Comet's ranking here reflects that risk mix: free and polished for consumers, but contested platform access is an existential variable for a shopping-centric agent, and security researchers have repeatedly probed agentic browsers' injection surface. Best for: consumers who want a zero-cost agentic browser today and accept that its most distinctive feature is under litigation.

Also watching: Fellou, Genspark, and TinyFish

Three players did not make the top table but shape the field. Fellou, the first self-described agentic browser, shipped Fellou 2.0 in June 2025 with task success jumping 31% to roughly 80%, and sits at version 2.5.15 as of January 2026. Genspark grew from a phone-calling workspace app into a $250M-ARR company valued at $2.6B after a $100M Series B extension on June 17, 2026, with 6,000+ business clients - Yahoo Finance. TinyFish scores 90.0% on Online-Mind2Web, ahead of most household names. The lesson: this category still produces credible new entrants every quarter, which is precisely why static vendor lists rot so fast.

5. The Browser Wars: Atlas vs Comet vs Claude for Chrome vs Fellou

The single biggest product shift since our original edition is that the browser itself became the battleground. In 2025, agents were features inside chat apps. By mid-2026, four distinct camps are fighting to own the surface where knowledge work actually happens, and the architectural split from section 3 maps directly onto the combatants: Atlas, Comet, and Fellou are standalone Chromium forks, Claude for Chrome is an extension in your existing browser, and Chrome+Gemini is the incumbent absorbing the feature.

The strategic logic differs per camp, and it pays to reason it from first principles rather than market-share headlines. A fork owns everything (defaults, data, monetization) but must win the hardest consumer behavior change in software: getting people to switch browsers. An extension rides the browser people already use, converting install friction into a permission prompt, but lives at the mercy of the host platform's policies. The incumbent simply ships the feature to billions and waits. History suggests defaults win consumer scale while specialists win power users, and the early evidence fits: Chrome+Gemini auto-browse targets 200 million Android devices by end of 2026, while Atlas agent mode remains gated behind ChatGPT Plus at $20/mo or Pro at $200/mo - landscape guide.

The security dimension cuts across the marketing. An agentic browser holds your logged-in sessions, which makes it the most valuable prompt-injection target ever shipped to consumers. Anthropic published hard numbers on this: adversarial red-teaming of Claude for Chrome cut general attack success from 23.6% to 11.2%, and browser-specific attacks from 35.7% to 0% - Claude blog. Competing vendors have published less, and independent researchers keep finding working injections against fork browsers. Until the industry converges on measurable defense reporting, the honest buyer's heuristic is: prefer vendors that publish attack numbers over vendors that publish adjectives.

Where does this settle? Our first-principles read is that the browser war is really a distribution war for the agent layer, and it ends the way toolbars and search defaults ended: the incumbent captures the mass market, one or two forks survive on differentiated power users, and the extension model persists as the enterprise-controllable option. What is genuinely new is that the losers will not just lose market share, they may lose platform access through litigation like Amazon v. Perplexity, which is why the legal section of this guide is no longer an appendix but a core chapter.

6. Native Computer Use in the Model Layer

The quiet architectural headline of 2026 is the death of the standalone computer use model as a product category. In 2025, computer use was a special-purpose artifact: OpenAI had a dedicated CUA model behind Operator, Google had Mariner's bespoke stack, and Anthropic gated a beta tool behind API headers. In 2026, every major lab folded the capability into its general frontier models: GPT-5.4 became the first general model with native SOTA computer use, GPT-5.5 carries it forward at 78.7% OSWorld-Verified, and Gemini 3.5 Flash integrated it natively on June 24, 2026 - Google.

Why does this matter beyond taxonomy? Because it changes the economics and the interface. When computer use is native, you stop paying a capability premium for a specialist model and start paying ordinary token prices: GPT-5.4 at $2.50/$15, Sonnet 5 at an introductory $2/$10, Gemini Flash-tier below that. It also means the same model that reasons about your task executes it, removing the brittle handoff between a planner model and an actor model that plagued 2025 architectures. Anthropic's implementation remains formally beta, gated by the computer-use-2025-11-24 header across the Sonnet 5 and Opus 4.x generations - Anthropic docs, while OpenAI still lists a legacy computer-use-preview model at $1.50/$6.00 batch pricing for backward compatibility - OpenAI pricing.

The strategic consequence is that differentiation moved up the stack. When every frontier model can click and type competently, the value shifts to orchestration: how an agent plans, verifies, recovers from failure, and knows when to use an API instead of a mouse. That is exactly where specialists like Browser Use (Auto-Research), Simular (Behavior Best-of-N), and platforms like O-mega (skill libraries and session routing) compete, and it is why the leaderboards now show orchestrated systems beating raw models. The model layer commoditized the hands; the fight is now about the brain that directs them, a dynamic we analyze across the broader stack in our guide to building AI agents in 2026.

7. Key Use Cases and Applications

The use-case map matured with the technology. In 2025, the honest answer to "what do people use these for" was demos, price checks, and brave pilots. In 2026 we finally have usage data at scale, and it contradicts the intuition that agents are mostly a developer toy. Anthropic's analysis of 1.2 million Claude Cowork sessions (May 2026) found business process work at 33.4% of usage, content creation at 16.4%, and software development at only 8.7% - TechCrunch. The center of gravity for computer-using agents is the operational middle office: the invoice chasing, data reconciliation, listing management, and report assembly that no SaaS vendor ever fully absorbed.

Concretely, the workloads that recur across platforms cluster into a handful of families. Each is worth understanding through the lens of the previous sections: which architecture it needs, and what failure costs.

• Web research and monitoring: multi-site comparisons, competitor tracking, structured data extraction from unstructured pages
• Form-heavy administration: government portals, supplier onboarding, insurance claims, compliance filings
• Commerce operations: listing updates across marketplaces, inventory checks, price adjustments, order status chasing
• Legacy application bridging: moving data between systems that never got APIs, the classic RPA estate
• Personal productivity: bookings, returns, subscription management, email triage inside agentic browsers

The pattern behind the pattern: agents win where work is repetitive, rule-describable, and interface-bound, and they still struggle where judgment is contested or the cost of a single error is catastrophic. A useful heuristic from practitioners is to score candidate workflows on frequency times friction divided by blast radius: automate the daily 20-minute chore whose worst failure is a retry, keep humans on the quarterly filing whose worst failure is a fine. Note also the asymmetry benchmarks hide: OSWorld measures whether a task can be done, but operations care whether it is done the same way every time, which is why reliability-first products like Nova Act (90%+ on defined workflows) sell against flashier generalists.

A worked example makes the economics tangible. Consider a mid-sized e-commerce operation that lists on three marketplaces, each with its own seller portal and none with a full write API for the fields that matter. Before agents, a coordinator spent roughly 90 minutes daily synchronizing stock levels, correcting flagged listings, and pulling order exceptions across the three dashboards. The agentic version splits by blast radius: a browser agent handles the read-heavy sweep (collect flags, exceptions, and stock mismatches into one report) fully autonomously, because a failed read costs nothing but a retry, while the write actions (price changes, listing edits) run through a review queue where the human approves batches in about ten minutes. Net result: the same coordinator now oversees the process instead of performing it, error rates on the writes drop because every change carries a logged before/after diff, and the marginal cost of the agent runs lands well under $2 per day at Sonnet 5 or GPT-5.4 prices. Nothing in that design required frontier capability; it required the routing discipline from section 3 and honest accounting of which steps are reversible.

The same decomposition logic generalizes to the other workload families. Research sweeps, monitoring, and data collection go autonomous first because their failure mode is a gap, not damage. Form submissions and record edits go second, gated by approvals until the error history earns wider autonomy. Payments, legal filings, and anything customer-visible go last, if ever, and always with a human on the trigger. Teams that sequence adoption this way build institutional trust in agents the same way they would with a new hire: expanding scope as the track record accumulates, with the logs to justify each expansion.

For individual professionals, the most consequential change is that this capability now arrives bundled into tools you already have: agent mode in the browser, Copilot Actions in Windows, Cowork attached to your Claude subscription. For teams, dedicated platforms (from Copilot Studio to O-mega) matter when work must be assigned, monitored, and audited rather than fired off ad hoc. The dividing line is accountability: the moment an agent's output feeds a business process, you need session logs, approvals, and a named owner, which consumer agent modes do not provide.

8. Security in the Wild: Prompt Injection Left the Lab

In our 2025 edition, prompt injection was a hypothetical illustrated with lab demos. That era is over. On March 3, 2026, Palo Alto Networks' Unit 42 documented web-based indirect prompt injection in the wild, including a December 2025 case where scammers embedded hidden prompts in ad landing pages to manipulate AI ad-review systems into approving malicious ads, and catalogued 22 payload-engineering techniques observed or reproduced - Unit 42. The attack pattern is exactly what researchers warned about: the agent reads a page, the page contains instructions, and the agent cannot fully distinguish content from commands.

First principles explain why this is the defining security problem of the category. A computer-use agent is, by construction, a system that treats what it sees as input. Every webpage, email, PDF, and popup is untrusted data flowing into the same context that holds the user's instructions and, in extension-model browsers, the user's authenticated sessions. Traditional security had a name for mixing code and data channels: injection, the vulnerability class behind two decades of SQL exploits. Agentic browsing rebuilt it at the semantic layer, where no parser can cleanly separate the channels.

The vendor responses now come with measurable numbers, which is itself progress. Anthropic's adversarial program cut prompt-injection attack success on Claude for Chrome from 23.6% to 11.2% overall, and browser-specific attack classes from 35.7% to 0% - Claude blog. Google shipped auto-stop safeguards with Gemini 3.5 Flash computer use that halt execution on detected manipulation - Google. OpenAI has been notably candid that injection may never be fully patched, positioning defenses as risk reduction, not elimination. OWASP's 2026 guidance treats agentic injection as a top-tier risk with in-the-wild exploitation, not a theoretical entry.

For anyone deploying agents, the practical posture in 2026 follows from the architecture section. Separate the agent from ambient authority (isolated sessions beat your logged-in browser for anything sensitive), scope credentials per task rather than per agent, gate irreversible actions (payments, deletions, sends) behind human confirmation, and log every step so incidents are reconstructable. None of this makes injection impossible; it makes the blast radius of a successful injection survivable, which is the correct engineering goal for a vulnerability that cannot be patched away.

9. The Law Arrived: Amazon v. Perplexity and Agentic Commerce

The legal system delivered its first major precedent for agentic computer use on March 10, 2026, when Judge Maxine Chesney granted Amazon a preliminary injunction against Perplexity's Comet shopping agent. The ruling's core holding is the sentence every agent builder should memorize: Comet accessed accounts "with the Amazon user's permission, but without authorization by Amazon" under the Computer Fraud and Abuse Act - PYMNTS. In other words, your user's consent does not confer the platform's authorization. Perplexity appealed, and the Ninth Circuit stayed enforcement on March 17, so the doctrine is live but unsettled.

From first principles, this dispute was inevitable, because agentic commerce breaks an implicit contract of the consumer web. Retail platforms monetize human attention: recommendations, sponsored placements, house brands, impulse adjacency. An agent that logs in as you, ignores the merchandising, and executes a pure price-and-specs comparison strips all of that value while consuming the platform's infrastructure. Platforms were always going to fight for the right to distinguish human sessions from delegated ones; the only question was which legal theory would carry, and the answer (for now) is the CFAA plus terms-of-service.

The counter-model already exists. Walmart and Target have taken collaborative paths, working toward sanctioned agent access and structured commerce interfaces rather than blanket bans, betting that agent-mediated purchases are a channel to win rather than an attack to repel. This split mirrors every prior gatekeeping war (search scraping, news snippets, API access), and it tends to end in negotiated, paid, structured access for agents: the commerce equivalent of what MCP provides for tools. Our guide to agent payments infrastructure maps the rails being built for exactly that outcome.

Until the appeal resolves, deployers of shopping or booking agents inherit real compliance homework. If your agent authenticates to a third-party platform, the injunction logic says the platform's terms and technical controls govern, regardless of user consent; robots.txt, login walls, and agent-detection headers become legal facts, not just engineering obstacles. Enterprise buyers should ask vendors two questions: which platforms has your agent been explicitly authorized to operate, and what happens to my workflows if one of them sends a cease-and-desist. Vendors with sanctioned integrations and API-first fallbacks carry materially less risk than vendors whose demos depend on contested access.

10. Consolidation and Casualties: Who Lived, Who Died

Eighteen months of this market compressed a decade of corporate drama. The original edition profiled a field of ambitious standalone products; the refresh must record which of them survived contact with 2026. The table below is the obituary-and-promotion ledger since late 2025.

Read as a whole, the ledger shows three simultaneous forces. Absorption: standalone agent products from the big labs became model features (Operator, Mariner), confirming section 6's thesis that computer use is a capability, not a product. Geopolitics: the Meta-Manus block established that top agent startups are now strategic assets subject to national-security review in both Washington and Beijing, which changes exit math for every founder and investor in the space - Sacra. Insurgency: open-source and specialist players (Browser Use, UI-TARS, TinyFish) took benchmark leadership from the labs, because orchestration on top of commodity models turned out to be a game small teams can win.

For buyers, the consolidation lesson is blunt: vendor mortality is a first-order risk in this category. Two of the three flagship products of early 2025 no longer exist as products. Contracts should assume migration: prefer platforms built on portable standards (MCP tools, standard browsers, exportable skills and logs) over bespoke stacks, and treat any single-model dependency as technical debt. The vendors most likely to still exist in 2028 are those with either distribution moats (Microsoft, Google, OpenAI, Anthropic) or revenue-funded independence (Manus at $450M, Genspark at $250M ARR), not necessarily those with the best demo today.

11. Platforms, Pricing and the July 2026 Buyer's Guide

Pricing in this category finally became legible in 2026, because computer use collapsed into ordinary model pricing plus subscription tiers. The table below is the state of the market as of July 8, 2026, with sources; treat anything older than a quarter as suspect, per the half-life rule from section 2.

Two structural observations make this table more useful than a price list. First, batch and cache discounts change everything for automation: Anthropic's batch API cuts prices 50% and cache hits cost $0.50 per million input tokens, which matters enormously for agents that re-read the same screens; OpenAI's cached input at $0.50 on GPT-5.5 works the same way - OpenAI pricing. Second, the preview tier is coming down fast: GPT-5.6 Sol, Terra, and Luna (limited preview June 27, 2026) are tracked by third-party pricing monitors at roughly $5, $2.50, and $1 per 1M input tokens respectively, preview-stage numbers to treat with caution - AI pricing tracker.

The right way to compare these numbers is cost per completed task, not cost per token. A typical live-web task consumes on the order of 50-150 screenshots and action rounds; at Sonnet 5 or GPT-5.4 prices that lands in the single-digit cents to low dimes per task, which is why per-task economics stopped being the adoption blocker it was in 2025. The real cost drivers now are failure retries (an 85% success rate means 15% of runs are pure waste plus cleanup) and human review time for gated actions. A cheaper model with a lower success rate is frequently the more expensive system: run the arithmetic on your actual workflow before optimizing the token line. Our deep dives on Opus 4.8, Sonnet 5, and GPT-5.5 include worked cost examples.

For non-developers, the subscription math is simpler. If your work lives in the browser and you already pay for ChatGPT Plus, Atlas agent mode is effectively bundled. If you want autonomy without any setup, Manus at $20/mo is the lowest committed entry to a real autonomous agent. If you need agents operating as an accountable team with logs, approvals, and reusable skills, a managed workforce platform like O-mega prices on usage rather than seats, which tends to win once volume is real. And if you are enterprise-committed to Microsoft, Copilot Studio's GA computer-using agents ride your existing licensing conversation - Microsoft.

12. The Open-Source Stack in 2026

The most underreported story in this field is that open agents now beat closed first-party agent modes on live-web benchmarks. Browser Use's bu-max holds the Online-Mind2Web record at 97.0%; ByteDance's UI-TARS-2 scores 88.2% with open weights; Simular's Agent S3 claims 72.6% OSWorld, above the human baseline. Meanwhile ChatGPT Atlas's consumer agent mode sits at 71.0%. The open stack did not just catch up, on the metrics that measure real websites it is ahead.

Why did open source win this particular hill? From first principles: once the perception-action capability commoditized into every frontier model (section 6), the differentiator became orchestration engineering, which is iterative, empirical, and benefits from thousands of contributors filing failure cases. Open projects iterate on recovery strategies, retry logic, DOM heuristics, and site-specific quirks at a cadence no product team matches. The same dynamic played out earlier in web scraping and DevOps tooling: when the problem is a long tail of environments, open ecosystems grind it down faster.

The practical open-source menu in July 2026 has three tiers. Browser Use for web work: a Python framework plus optional cloud, the default first evaluation for engineering teams. UI-TARS Desktop / Agent TARS for full GUI control with open weights, 37.8k GitHub stars and a CLI-to-desktop span - GitHub. Agent S3 for research-grade desktop scaffolding with Behavior Best-of-N reliability techniques - Simular. All three assume you bring the guardrails: sandboxing, credential scoping, injection defenses, and monitoring are on you, which is the honest price of the capability being free.

The build-versus-buy decision therefore reduces to whether agent operations is a competence you want to own. Teams with platform engineers get record-setting capability and full control from the open stack. Teams without them get better outcomes from managed layers (Copilot Studio, Nova Act, O-mega, or the labs' own agent products) that wrap the same underlying capabilities in accountability. The worst position in 2026 is the middle: a hand-rolled agent stack with no owner, no logs, and production credentials, which is precisely the deployment pattern Unit 42's incident write-ups keep finding.

13. Windows as an Agent Platform and the MCP Standards Layer

Two infrastructure shifts since our original edition will outlast every product named in this guide. The first is that Windows itself became an agent platform. Microsoft rolled Copilot Actions and Agent Workspace to Windows Insiders with contained, low-privilege agent accounts: agents run as separate identities with their own permissions, not as the human user, which is the OS-level version of the separated-architecture principle from section 3. Copilot Studio's computer-using agents hit GA on May 26, 2026 with secure credential management, model selection, and embedding into multi-step workflows - Microsoft. At Build 2026 the Windows Agent Framework was open-sourced, and Agent 365 ships standard in the October 2026 Windows release, giving agents the same lifecycle tooling (provisioning, policy, audit) that employees' accounts get. This is a long way from the days when Microsoft's screen-reading ambitions amounted to Copilot Vision.

The second shift is that the standards layer grew up. The Model Context Protocol, which our 2025 edition mentioned only as a connector feature at Ignite, was donated by Anthropic to the Agentic AI Foundation under the Linux Foundation on December 9, 2025, co-founded with Block and OpenAI and backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg - Anthropic. MCP now counts 10,000+ active public servers and 97M+ monthly SDK downloads, which makes it the de facto USB port of the agent economy; we traced its origins in our early MCP launch coverage back when it was an Anthropic side project.

These two shifts interlock into a coherent architecture for the category's future. MCP answers "how does an agent use tools with a machine interface" (structured, cheap, deterministic), while computer use answers "how does an agent use everything else" (visual, expensive, probabilistic). The mature 2026 agent checks for an MCP server first and falls back to pixels second, and platform vendors increasingly publish MCP servers precisely so agents stop scraping their UIs, a dynamic that quietly defuses some of the legal conflict from section 9: sanctioned structured access is cheaper for everyone than contested visual access.

For organizations, the planning implication is to invest in the layer that persists. Products churn (section 10 proved it), but agent identity, tool standards, and audit infrastructure compound. Publishing MCP servers for your internal systems, adopting per-agent identities and scoped credentials, and standardizing session logging will pay off regardless of which vendor's agent you run in 2027, which is the same reason building an MCP server became the most practical first step for teams entering this space.

14. Reality Check and Future Outlook

An honest guide has to hold two contradictory-sounding forecasts at once, and Gartner conveniently supplies both. On one hand, Gartner predicts 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from under 5% in 2025 - Gartner. On the other, Gartner separately predicts over 40% of agentic AI projects will be canceled by end-2027 on cost and unclear ROI. Both can be true, and probably are: the capability is diffusing into everything while a large share of bespoke agent projects fail, exactly the pattern of every general-purpose technology's first deployment wave.

The failure modes behind that 40% cancellation number are consistent and avoidable. Projects fail when they aim pixel-level agents at problems that already have APIs (paying token prices and error rates for what a cron job does perfectly), when they automate the demo instead of the workflow (no logs, no retries, no owner), and when they skip the security architecture until after the first incident. The decision framework below compresses this guide's argument into the choice that matters most.

Looking out 12-18 months, four trajectories seem well-supported rather than speculative. Benchmark leadership will keep rotating toward orchestrated systems and live-web tests as OSWorld saturates. Distribution will beat capability in the consumer browser war, favoring Chrome's incumbency and bundled agent modes. Law and standards will converge on sanctioned agent access (negotiated commerce interfaces, MCP everywhere) because contested access is expensive for both sides. And the agent workforce model (named, persistent, auditable agents rather than anonymous one-shot sessions) will keep moving from early adopters into normal operations, because accountability is what lets automation survive its first incident review.

The decision framework, compressed

If you remember five things from 14 sections, make them these. Anchor on dated numbers: any computer use claim without a date is unusable, and any number older than two quarters is probably wrong. Choose architecture before vendor: decide what the agent may inherit (your browser, a sandbox, an OS account) and let that eliminate most of the market for you. Route API-first, pixels-second: computer use is the tool for interface-bound work, not a lifestyle. Demand published security numbers: vendors that measure injection resistance (Anthropic's 35.7% to 0% browser-attack reduction is the reference standard) are strictly preferable to vendors with adjectives. Design for vendor mortality: two of 2025's three flagship products are gone; portable standards and exportable logs are your insurance.

The field went from 14.9% to 85.4% while this article sat unrevised for seven months, and the next revision will make some of today's numbers look quaint just as fast. That is not a reason to wait. The buyers getting value in July 2026 are not the ones who picked the perfect platform, they are the ones who built the habits of safe delegation (scoped credentials, gated actions, logged sessions) on whatever platform they started with, and can now swap engines underneath.

Written by Yuma Heymans ( @yumahey), founder of O-mega, who has spent the past two years building and stress-testing browser and computer-session agents for business workforces, including the benchmark tracking behind this guide's rankings.

This guide reflects the agentic computer use landscape as of July 8, 2026. Benchmarks, pricing, and product availability in this field change monthly: verify current details against the linked primary sources before making purchasing decisions.