AI Computer Use Benchmarks 2026: Top Agents Ranked

The September 2026 field guide to computer-use benchmarks, the agents that top them, and what the leaderboard numbers actually mean for your work

AI agents went from completing 34.5% of real desktop tasks to 86.1% in roughly fifteen months, blowing past the ~72% human baseline on the field's flagship benchmark. Then, on June 26, 2026, the same research lab that built that benchmark released a harder one, and the best model in the world dropped back to 20.6% - OSWorld 2.0. Ten weeks later that frontier had climbed to 77.9% - llm-stats OSWorld 2.0 tracker. That whiplash, from saturation to humility and back again inside a single summer, is the defining story of computer-use AI in 2026, and it is why almost everything written about agent benchmarks in 2025 is now dangerously out of date.

This guide was originally published as a 2025 benchmark overview. We have rewritten it top to bottom for the September 2026 landscape, because the field did not just move, it inverted. The 2025 storylines (Writer's Action Agent topping GAIA, OpenAI's Operator as a standalone research preview, OSWorld state of the art sitting in the low thirties) are all dead. In their place: OSWorld-Verified as the standard citation, OSWorld 2.0 as the new frontier, Online-Mind2Web as the live-web standard, an entire agentic browser category that did not exist when the original article was written, and a wave of Chinese open-weight GUI agents that now sit on top of several trackers.

What you will get here: the current leaderboards with dates and sources, a ranked assessment of the top computer-use agents you can actually run today, the token-economics math nobody else publishes (what a completed long-horizon task actually costs in dollars), an honest section on why vendor benchmark numbers are not comparable, and a corrections block that names what died since 2025. Platforms like O-mega sit downstream of all of this: when you run an AI workforce that operates browsers and computers for you, the question "which agent actually completes tasks, at what cost" stops being academic. This guide answers it with September 2026 data.

Contents

1. What Changed Since 2025: From Saturation to OSWorld 2.0
2. The September 2026 Scoreboard: Who Leads Each Benchmark
3. The Benchmark Canon in 2026: What to Cite and What to Ignore
4. Benchmark Integrity: Why the Numbers Are Not Comparable
5. Token Economics: What a Completed Task Actually Costs
6. The Model Lineup: Anthropic, OpenAI, Google, ByteDance
7. Desktop Agents You Can Actually Buy in July 2026
8. The Agentic Browser Wars
9. China's Computer-Use Surge: Seed 2.1 and UI-TARS-2
10. What Died Since 2025: The Corrections Block
11. Models vs Harnesses vs Infrastructure: The Three-Layer Stack
12. Security and the Agentic Traffic Explosion
13. What to Watch Next and How to Choose

The September 2026 Assessment: Top Computer-Use Agents Ranked

Before the deep dives, here is the master table. We scored the eight most important computer-use systems of September 2026 on four criteria: OS-level control (30%, anchored on OSWorld-Verified and OSWorld 2.0 results), live-web agency (25%, anchored on Online-Mind2Web and real-website task completion), cost per completed task (25%, derived from current API pricing and measured token consumption), and access and ecosystem (20%, how easily you can actually deploy it today). Every cell contains the score and the reason for it.

Two readings of this table matter more than the ranking itself. First, ranks two and three are tied to the decimal while representing opposite philosophies: Claude Fable 5.1 buys peak long-horizon completion at $10/$50, while Qwen3.8-Max buys near-equal desktop control at a fifth of the price with weights you can download. Which one "wins" depends entirely on whether your task must be finished or must be cheap, a tradeoff we quantify in dollars in section 5. Second, the presence of Qwen3.8-Max and UI-TARS-2 in the top six would have been unthinkable in the 2025 version of this article, which did not mention a single Chinese lab. The September 2026 leaderboards do not permit that omission anymore.

1. What Changed Since 2025: From Saturation to OSWorld 2.0

The single most important fact in this entire guide is a narrative arc, not a number. In mid-2025, the state of the art on OSWorld, the benchmark that measures whether an AI can operate a real Ubuntu desktop (files, browsers, office apps, system settings), was 34.5%, held by Simular's Agent S2, with OpenAI's computer-use models around 32.6% on the 50-step split. The original version of this article reported those numbers as the frontier. Fifteen months later, the Steel.dev cross-benchmark leaderboard shows Alibaba's Qwen3.8-Max at 86.1% on OSWorld-Verified, ahead of Claude Mythos Preview at 85.4% and Claude Fable 5 at 85.0%, all comfortably above the 72.36% human baseline that the benchmark's own authors measured. Agents did not just improve. On this specific test, they became better than the people the test was calibrated against, and the model now sitting at the top of it ships with downloadable weights.

The XLANG Lab, which maintains OSWorld, said the quiet part out loud: agents scoring 83.5% does not mean the problem is solved, it means the benchmark stopped measuring the problem - OSWorld-V2 on GitHub. Their response, released June 26, 2026, is OSWorld 2.0 (also written OSWorld-V2): 108 long-horizon workflows across seven professional domains, with a median human completion time of roughly 1.6 hours per task. Where OSWorld 1.0 tasks averaged about 30 tool calls, OSWorld 2.0 tasks average 318 tool calls when run with Claude Opus 4.7 at maximum thinking budget. These are not "change the wallpaper and save a file" tasks. They are "reconcile this dataset across three applications, produce the report, and fix what breaks along the way" tasks.

The scores reset accordingly, and then they did not stay reset. At launch, the best model on OSWorld 2.0 completed 20.6% of tasks at a 500-step budget, consuming about 244K output tokens per task in the process, while the most efficient one plateaued near 13-14% on roughly 39K output tokens - OSWorld 2.0. By September 2026 the board reads Claude Fable 5.1 at 77.9%, GPT-6 Astra at 72.6%, and Claude Opus 5 at 70.6% - llm-stats. Ten weeks, roughly a tripling. Section 4 explains why those two sets of numbers are not the clean before-and-after they look like. The benchmark authors also published where agents break: cross-source reasoning appears in 42.6% of tasks, visual-spatial precision in 41.7%, implicit-state inference and multi-item state tracking in 39.8% each, and the single most damaging failure mode is the recovery and maintenance of hidden state, the context a human keeps in their head across a two-hour workflow.

It is worth pausing on why saturation happened this fast, because the mechanism predicts what happens next. Three forces compounded. Verified environments removed noise: once OSWorld-Verified fixed its 300+ broken tasks and standardized infrastructure, labs could optimize against a stable target instead of chasing evaluation artifacts. Reinforcement learning on real GUI interaction replaced supervised imitation as the dominant training recipe, a shift visible in everything from Anthropic's agentic training disclosures to ByteDance's UI-TARS-2 paper, and RL is exactly the technique that converts a stable target into rapid score growth. And 50x parallel evaluation collapsed the iteration loop from days to hours, so every experiment cycle got cheaper at the same moment the training signal got stronger. The same three forces were pointed at OSWorld 2.0 the moment it shipped, which is why its 20.6% frontier did not survive the summer, let alone the winter. If you want a rule of thumb for how long a fresh agent benchmark stays informative once the labs aim at it, ten weeks is now the observed number.

The seven professional domains in OSWorld 2.0 also deserve a mention, because they define what "long-horizon" means concretely: the workflows span office productivity, data work, professional creative tools, and system administration, with tasks routinely requiring the agent to move outputs between applications and to notice when an earlier step silently failed. The median 1.6-hour human completion time is the tell - osworld-v2.xlang.ai. These are tasks you would assign to a junior colleague with a written brief, not tasks you would dictate to an assistant sentence by sentence. That is the bar the field has decided to measure itself against for the next cycle, and it is the right bar, because it is the one that maps to actual jobs rather than isolated actions.

Why this matters practically: if you evaluated an agent vendor in 2025 and walked away unimpressed, your data is stale in the specific direction of underestimating the field. If you are reading a vendor's deck in September 2026 that quotes "85% on OSWorld," you now know that number describes a saturated test that the research community has already replaced. The honest one-line summary of the field is this: short-horizon computer use is solved at the frontier, and long-horizon computer use is roughly three-quarters solved on the generous scoring and closer to two-fifths on the strict scoring. Both halves of that sentence are new since 2025, and the gap between those last two figures is the whole argument of section 4. For how the previous Anthropic generation behaved on these workloads, and what carried into Opus 5, see our Claude Opus 4.8 benchmark guide, on Founden.ai, a site we also run.

2. The September 2026 Scoreboard: Who Leads Each Benchmark

Numbers in this field rot fast, so every score in this section carries its date and source. The anchor benchmark for desktop control remains OSWorld-Verified, the cleaned-up AWS-hosted successor to raw OSWorld that XLANG introduced on July 28, 2025, fixing over 300 task issues and enabling 50x parallel evaluation - xlang.ai. When someone cites "OSWorld" in 2026 without the "Verified" qualifier, ask which one they mean; the numbers differ, and section 4 explains why that matters.

The top of that chart used to be an Anthropic sweep. It is not anymore: Alibaba's Qwen3.8-Max, released August 3, 2026 as a 2.4-trillion-parameter mixture-of-experts model with 95B active parameters and a 1M-token context window, took the lead at 86.1%, ahead of Claude Mythos Preview at 85.4%, Claude Fable 5 at 85.0%, Claude Opus 4.8 at 83.4% and Claude Sonnet 5 at 81.2% - Steel.dev. OpenAI's last entry here is GPT-5.5 at 78.7%, and Google's newest models report on OSWorld 2.0 instead of this board, per DeepMind's own model page. That silence is itself informative: labs stop submitting to a benchmark once it stops separating them. Note what the human baseline sitting at the bottom of the chart implies: on short-horizon desktop tasks, every frontier model now outperforms the average human tester. That is precisely the condition under which a benchmark stops discriminating and the field needs a new one.

The new one told a different story for about ten weeks, and then told the same story faster. On OSWorld 2.0, launch-week scores sat in the teens; by September the leaders had compressed into a high band with wildly different resource consumption behind each number. The comparison below is, in our view, the single most informative chart in computer-use AI right now, because it shows how quickly a "hard" benchmark stops being hard.

On the live web, the standard has consolidated around Online-Mind2Web: 300 tasks across 136 real, live websites, difficulty-tiered from Easy (1-5 steps) through Hard (11+ steps) - Browser Use. The current leader is Browser Use Cloud (bu-max) at 97.0%, a specialized browser-agent harness rather than a raw model, and that board has not moved since June 29, 2026 - Steel.dev Online-Mind2Web leaderboard. A live-web benchmark whose leader is four months stale while three frontier models shipped underneath it is worth noticing: nobody has rerun it on the current generation, so its entries describe the models of last spring. For historical contrast: the systems that defined early 2025, the Claude 3.7-era Computer Use stack and OpenAI's Operator, scored around 61% on the same benchmark. Anthropic's stack scored around 84% in Browserbase's evaluation of Claude Opus 4.8, and ByteDance's open-source UI-TARS-2 posts 88.2 - arXiv.

Beyond those two anchors, the September 2026 state of the rest of the canon, per the Steel.dev cross-benchmark leaderboard updated September 4, 2026: WebVoyager is led by a browser-control harness at 99.19% (saturated past the point of meaning), WebArena by WebTactix at 74.3%, GAIA by OPS-Agentic-Search at 92.36% (effectively saturated and superseded by GAIA2), SWE-bench Verified by Claude Opus 5 at 97.00% on the Vals.ai run, tau-bench by Step-3.5-Flash at 88.2%, and BrowseComp by GPT-5.6 Sol Ultra at 92.2%. On the terminal side, Terminal-Bench at tbench.ai is the citation both Anthropic and Google use in their model cards, and it has just been through its own reset, covered below. We maintain a broader cross-model snapshot in our AI model benchmarks and pricing guide if you want the non-agentic numbers too.

Terminal-Bench merits more than a short aside now, because it is the cleanest natural experiment in this guide on what a benchmark reset actually costs a score. Terminal work is text-native, deterministic and verifiable, which is why agents got strong there first. Google's own model page reports Gemini 3.8 Flash at 89.4% on Terminal-Bench 2.1 and 19.1% on Terminal-Bench 4.0: the same model, the same model card, a seventy-point drop from nothing but changing which tasks you ask for. Anthropic's September numbers show how much of that gap is benchmark and how much is model, because its stack holds up far better on the harder version: Mythos 5.1 at 60.9%, Fable 5.1 at 55.8% and Opus 5 at 52.3% on Terminal-Bench 4.0 - Anthropic. Nothing about Gemini regressed. Its measurement got honest, and the honest one ranks it very differently. That single pair of Gemini numbers is the most useful thing in this section, because it puts a magnitude on a claim the rest of the industry makes only qualitatively: a saturated benchmark can overstate capability by a factor of four, and it hides ranking changes as well as absolute ones. It also explains why teams automating infrastructure get production value from agents today that teams automating GUI-only legacy software cannot yet match. The strategic implication cuts both ways: if a workflow can be moved from a GUI to a scriptable interface, its automation ceiling jumps immediately, and the highest-ROI "agent project" in many organizations is actually an API-enablement project wearing a different name.

Reading that scatter of names correctly requires knowing which of these boards still discriminate. WebVoyager at 99.19% is a solved test; its residual is mostly ambiguous task definitions, so treat any vendor still leading with a WebVoyager number as decorating rather than informing. WebArena's 74.3% ceiling looks unsaturated, but the leader runs an older open-weight model under a specialized harness, which says more about the harness layer (section 11) than about frontier models, most of which do not bother submitting. GAIA's 92.36% leader is an agentic-search specialist, and the benchmark's authors have effectively moved on to GAIA2, whose dynamic scenarios reset the difficulty the same way OSWorld 2.0 did for desktops. The pattern across all of them is identical and worth internalizing: every static agent benchmark introduced before 2025 is now either saturated or led by specialists, and the informative frontier lives on the 2026 generation of tests. A practical corollary for anyone commissioning agent work: ask vendors for numbers on OSWorld 2.0, Online-Mind2Web, GAIA2, and Terminal-Bench 4.0 specifically, and treat silence on all four as a signal in itself.

3. The Benchmark Canon in 2026: What to Cite and What to Ignore

Benchmarks are not neutral instruments. Each one embodies a theory of what "using a computer" means, and picking the wrong one for your use case will steer you to the wrong agent. The 2026 canon has consolidated hard since the sprawling benchmark zoo of 2025, and understanding what each test actually measures is the fastest way to read any vendor claim critically. This section walks through the tests worth citing today, in descending order of how often they should appear in your evaluations.

OSWorld-Verified is the default citation for desktop control. It runs agents against a real Ubuntu VM performing real application tasks, and since the July 2025 migration to AWS with 50x parallelization and 300+ task fixes, results are reproducible enough that labs stake launch claims on it - xlang.ai. Its weakness is now well documented: it is saturated. Scores above the ~72% human baseline cluster within a few points of each other, and differences up there tell you more about harness tuning than model capability. OSWorld 2.0 fixes exactly that with 108 long-horizon professional workflows averaging 318 tool calls, and it should be your primary reference whenever the workload you care about takes a human more than a few minutes - osworld-v2.xlang.ai. A vendor that quotes OSWorld-Verified but goes quiet on OSWorld 2.0 is telling you something.

For web work, Online-Mind2Web replaced the older static datasets because it runs on 136 live websites rather than cached snapshots, which means agents face real popups, real layout changes, and real anti-bot friction - Browser Use. WebVoyager and WebArena still appear in papers, but WebVoyager's 98.5% ceiling makes it a sanity check rather than a differentiator, and WebArena's simulated sites reward memorization of a fixed environment. For general assistant-style agency, GAIA2 superseded GAIA: 800 scenarios running inside Meta's Agents Research Environments with asynchronous dynamic events, continuous time, and capability splits for execution, search, adaptability, temporal reasoning, and ambiguity handling - Hugging Face leaderboard. The dynamic-events design matters: GAIA2 scenarios change while the agent works, which is much closer to a real inbox than a frozen question set.

Two more deserve a place in your reading list. Terminal-Bench 2.1 measures command-line agency (builds, scripts, system administration) and has become the shared citation across Anthropic and Google model cards - tbench.ai. And tau-bench measures tool-use reliability in conversational customer-service settings, where the current leader is Step-3.5-Flash at 88.2% - Steel.dev. What should you ignore? Anything that was a headline in mid-2025 and has no 2026 leaderboard activity: CUB has effectively vanished from the conversation, the 15-step and 50-step OSWorld splits are obsolete now that Verified standardized the protocol, and single-number "agent IQ" composites remain marketing. If you are building agents yourself rather than buying them, our insider guide to building AI agents, on suprsonic, a site we also run, covers how these benchmarks translate into architecture decisions.

GAIA2's design deserves one more paragraph, because it introduces a measurement idea the rest of the canon lacks: capability splits. Instead of a single success rate, the leaderboard reports separate scores for execution, search, adaptability, time handling, and ambiguity handling, run inside Meta's Agents Research Environments where events fire asynchronously while the agent works - Hugging Face. The splits matter because they expose failure shapes that aggregate numbers hide: an agent can be excellent at executing clear instructions and terrible at noticing that the situation changed mid-task, and those are different products even when their averages match. Expect the split-score idea to spread; OSWorld 2.0's published failure-phenomenon percentages (cross-source reasoning, hidden state, visual precision) are the same instinct applied to desktops, and both are far more useful to a buyer than a leaderboard rank.

The practical way to apply this canon: match the benchmark to the horizon of your workload. Short repetitive web tasks map to Online-Mind2Web. Desktop application work maps to OSWorld-Verified for a floor and OSWorld 2.0 for a ceiling. Ambient assistant duties map to GAIA2. Infrastructure and DevOps map to Terminal-Bench 2.1. No single number summarizes an agent, and any vendor who gives you one anyway has chosen the number that flatters them.

4. Benchmark Integrity: Why the Numbers Are Not Comparable

Here is the section most benchmark roundups will not write, because it complicates every clean table including ours. The uncomfortable truth of September 2026 is that agent benchmark scores are not directly comparable across vendors, releases, or even months, and there are four specific, documented mechanisms behind that.

First, the benchmark itself changes underneath the scores. This is no longer hypothetical for OSWorld 2.0. When Anthropic published Fable 5.1's results on September 1, 2026, it stated plainly that the scores run on the benchmark authors' August 2026 task release, that Fable 5 and Opus 5 were re-run under the same conditions, and that "because the task files differ from earlier releases, these numbers aren't directly comparable to previously published OSWorld 2.0 results" - Anthropic. The same disclosure gives the second half of the problem: Anthropic reports two OSWorld 2.0 numbers per model, a permissive "partial" setting and a strict one, and for Fable 5.1 they are 77.9% and 41.7%. For Opus 5 they are 75.4% and 39.6%. Nearly forty points of spread on one model, one benchmark, one day, decided entirely by which column a marketer chooses to quote. Third-party trackers add a third reading: llm-stats lists Opus 5 at 70.6% on its own binary run, and Meta's Muse Spark 1.3 launch table lists it at 68.3%. There is no conspiracy in any of that. There is also no single number for "how good is Opus 5 at computer use," and anyone who hands you one without a setting, a task release and a date is selling something.

Second, vendors change their own evaluation harnesses. When Anthropic launched Claude Opus 4.8, it also changed how it runs the OSWorld-Verified evaluation "to better reflect real-world performance" and retroactively revised Claude Opus 4.7's score to 82.3% - Vellum. The model did not change. The number did. That is a defensible methodology decision and Anthropic disclosed it, but it means a 4.7 score you read in a February article and a 4.7 score you read in a June article are different measurements wearing the same name. Every cross-release comparison chart you see, including the ones in this guide, inherits that caveat.

Third, the judge changes the score. Online-Mind2Web results depend heavily on who or what decides a task "succeeded": human evaluation, the automated WebJudge, and custom vendor-built agentic judges produce materially different results for the same agent on the same tasks. One vendor, Aside, self-reports 99.3% (297 of 299 tasks) using its own judging methodology - aside-benchmarks on GitHub. That number may be honest work, but it is not comparable to the 97.0% that Browser Use posts under the leaderboard's standard judge, and neither is comparable to a human-judged 84%. When you see a live-web score, your first question should be "judged by what?"

Fourth, step budgets and token budgets are silently load-bearing. The OSWorld 2.0 launch measurement is the clearest published example: the leading model's 20.6% was a 500-step number achieved with roughly 244K output tokens per task, while the most efficient competitor's ~13.5% came with a ~39K-token footprint - osworld-v2.xlang.ai. Cap both at a small budget and the ranking flips, because XLANG's own analysis shows small budgets favor the token-thrifty model while maximizing completion favors the expensive one. A leaderboard that publishes success rates without budgets is publishing half a measurement, and none of the September entries above publish theirs.

There is a fifth mechanism that no single scandal illustrates but that quietly distorts every saturated benchmark: optimization pressure. Once a benchmark becomes the industry's shared scoreboard, every lab's training and harness decisions get tuned against it, directly or indirectly, and the score stops being a random sample of capability and becomes the target of it. This is Goodhart's law operating at industrial scale, and it is the structural reason saturated benchmarks overstate general capability: the 85% club on OSWorld-Verified is partly "models got better at computers" and partly "models got better at OSWorld-shaped tasks." OSWorld 2.0's launch numbers were trustworthy precisely because nobody had had time to overfit them, and the ten weeks it took to go from 20.6% to 77.9% is the decay curve made visible. Fresh benchmarks are not just harder; they are epistemically cleaner, and their cleanliness decays on a schedule you can now roughly calibrate: about a quarter of sustained lab attention.

What should a buyer do with this? Not despair, but triangulate. Trust directionally consistent results across independent harnesses (Anthropic's OSWorld-Verified lead shows up on Steel.dev, in Browserbase's Online-Mind2Web testing, and in third-party writeups, so it is probably real). Distrust any single-source record, especially self-judged ones. Prefer leaderboards that publish their harness code and judge methodology, which is exactly why Steel.dev and the official OSWorld and GAIA2 boards have become the field's reference points. And when the stakes are real, run a 20-task pilot on your own workload, because your workflows are a benchmark no lab has ever seen. This is the approach we take internally at O-mega when selecting models for browser and computer sessions, and it regularly contradicts at least one published number.

5. Token Economics: What a Completed Task Actually Costs

Benchmark coverage in 2026 still mostly stops at success rates. But the OSWorld 2.0 results published enough resource data to do something more useful: compute the dollar cost of a completed long-horizon task, and the answer reshapes the "which model is best" question into "which model is best at what price."

Start with the raw inputs, all of them current as of this writing. Claude Opus 5 is priced at $5 per million input tokens and $25 per million output tokens with cache reads at $0.50, and Claude Fable 5.1 at $10/$50 with cache reads at $0.25 - Anthropic. GPT-6 Astra lists at $10/$50 with cached input at $1.00, rising to $20/$75 on long context, and the GPT-5.6 tier sits underneath it at $4/$20 for Sol, $2/$12 for Terra and $0.20/$1.20 for Luna - OpenAI. Gemini 3.8 Flash undercuts all of them at $0.75/$3.75 through December 31, 2026.

Now the arithmetic, using the OSWorld 2.0 launch measurement because it is still the only public dataset that pairs completion rates with per-task token consumption. At a 500-step budget, the high-completion model consumed about 244K output tokens per attempt to finish 20.6% of tasks, while the token-thrifty one spent about 39K to finish roughly 13.5%. At $25 per million output tokens, the first bills about $6.10 per attempt, and dividing by its completion rate gives roughly $29.60 per completed task. At $30 per million, the second bills about $1.17 per attempt and roughly $8.70 per completed task. Two caveats keep this honest: these are output-token floors (input tokens, which include repeated screenshots in computer-use loops, typically dominate the real bill and are not broken out per task in the public data), and failed attempts in production often get retried by different strategies rather than simply re-rolled. But the shape of the conclusion survives both caveats and the model turnover since: the thrifty model completes long-horizon tasks at roughly one third of the flagship's token cost, while the flagship completes roughly half again as many tasks overall.

The strategic reading is the important part, and it is the part that did not expire when the models did. If your workload consists of tasks both tiers can do, the cheap tier is the economically rational default, and its plateau does not hurt you. But a thrifty model's curve flattens regardless of additional steps, which means there is a band of harder tasks (roughly a third of what the flagship completes) that no amount of cheap-tier spend reaches. For those tasks, the flagship's premium is not a premium at all; it is the difference between done and not done, and the comparison price is not $8.70 but the hourly cost of the human who otherwise does a 1.6-hour workflow. At a loaded cost of even $50 per hour, the human comparison price is $80, which makes $29.60 in tokens look cheap. This is the calculation that agent platforms make on your behalf: at O-mega, routing logic exists precisely because the answer to "which model" changes per task, and pinning everything to one vendor leaves either capability or money on the table.

Scale the arithmetic up and the strategic stakes get clearer. Suppose an operations team wants to automate 1,000 long-horizon workflows per month, of the OSWorld 2.0 difficulty class. On the output-token floor alone, a flagship-only strategy prices at roughly $29,600 per month of completed work plus the cost of the attempts that fail and need human pickup; a cheap-tier-only strategy prices at roughly $8,700 for the subset it can complete and silently forfeits the harder third of the portfolio. A routed strategy (cheap model first, escalate failures to the expensive one) dominates both, which is not a novel insight in distributed systems but is strangely absent from most agent procurement conversations, where "pick a model" is still treated as a single decision. The other lever the raw math hides is prompt caching: computer-use loops resend large, mostly identical context (system prompts, tool definitions, screenshot histories), and cached input pricing changes the input side of the bill by multiples. That lever moved hard in September: Anthropic cut Fable's cache reads by 75% to $0.25 per million tokens while holding the headline $10/$50 unchanged, which it puts at roughly a 25% cost reduction on typical workloads and up to about 45% on highly agentic ones - Anthropic. A 45% discount that appears only on the workload shape this entire guide is about is the clearest evidence yet that headline per-token prices are the wrong unit for agent work. Vendors' caching discounts differ enough that the cheapest model per token and the cheapest model per cached agent-loop are frequently not the same model.

One more wrinkle worth pricing in: premium model tiers. Claude Fable 5.1 and Claude Mythos 5.1, both released September 1, 2026 at $10/$50 per million tokens, are the same underlying model with different deployment guardrails, and Fable 5.1's benchmark-leading 77.9% on OSWorld 2.0 comes at exactly double Opus 5's token price for 2.5 points over Opus 5's 75.4% under identical conditions - Anthropic. Paying 2x for 2.5 points is rarely rational; on your hardest live workflows, it sometimes is. We break the Fable and Mythos tier down further in our Claude Fable 5 and Mythos 5 benchmark guide.

6. The Model Lineup: Anthropic, OpenAI, Google, ByteDance

The 2025 version of this article described a field of research previews and experimental betas. The September 2026 field is a five-way race between shipping products, so this section profiles each lab's actual current lineup, with the stale claims from the original article explicitly corrected.

Anthropic has the strongest computer-use portfolio on paper and on leaderboards. The original article described Anthropic as having a 100K-token context window and "no standalone consumer agent product." Both claims are now absurd. Claude Opus 5, released July 24, 2026, holds the same $5/$25 pricing as the 4.8 generation it replaced while roughly tripling its long-horizon completion, and Anthropic's central claim for it is economic rather than absolute: on OSWorld 2.0 it "outperforms every other model at any given cost," matching Fable 5's best result at just over a third of the price - Anthropic. Above it sit Claude Fable 5.1 (generally available, safety classifiers with fallback, 77.9% on OSWorld 2.0) and Claude Mythos 5.1 (restricted to vetted partners under programs like Project Glasswing for cybersecurity and trusted biomedical access), both shipped September 1, 2026 - Anthropic. Claude Sonnet 5 rounds out the working tier at $2/$10 and 81.2% OSWorld-Verified, which is the number most teams should actually be shopping against. On the product side, Claude Cowork launched January 12, 2026 as a general desktop agent, and Simon Willison's early analysis noted that over 90% of Cowork usage is not software development - simonwillison.net. Full desktop control (screen vision plus virtual mouse and keyboard) arrived in research preview on March 23-24, 2026 for Pro and Max subscribers - CNBC. The restricted Mythos tier is worth watching separately; our Claude Mythos Preview insider guide tracks what its 85.4% OSWorld-Verified entry signals about the next general release.

OpenAI consolidated rather than fragmented. The original article's framing ("Operator and Deep Research, experimental betas based on GPT-4-era models") is two product generations gone: standalone Operator was shut down August 31, 2025, and its Computer-Using Agent capabilities were absorbed into ChatGPT agent mode, announced July 17, 2025 and available today on Plus at $20/mo, Pro at $100-200/mo, and Business at $25 per user per month, plus a computer-use tool in the Agents SDK - presenc.ai tracker. The current model is GPT-6 Astra, shipped September 3, 2026 with a 1.05M-token context window, a 128K maximum output and an April 30, 2026 knowledge cutoff, at $10/$50 per million tokens with cached input at $1.00 - OpenAI. Its computer-use pitch is throughput rather than headroom: 72.6% on OSWorld 2.0, reached in roughly 40 minutes per task against about 75 minutes for GPT-5.6 Sol, a 47% reduction in wall-clock time on identical work. The GPT-5.6 family (Sol, Terra, Luna) launched July 9, 2026 and now sits underneath Astra at settled pricing of $4/$20, $2/$12 and $0.20/$1.20 respectively, well below the $5/$30, $2.50/$15 and $1/$6 preview rates it was announced at - coursiv.io. We published a full GPT-5.6 benchmark and pricing breakdown as the launch data landed, and our GPT-5.5 complete guide covers the generation Astra was built on top of.

Google finally shipped the things the 2025 article said were "not fully released." The dedicated Gemini 2.5 Computer Use model exposes browser and UI control through the API and powers Project Mariner, the Firebase Testing Agent, and agentic capabilities in AI Mode in Search - Google. The current general lineup puts Gemini 3.8 Flash (September 2, 2026) at 59.0% on OSWorld 2.0 and 89.4% on Terminal-Bench 2.1 against 19.1% on Terminal-Bench 4.0, at $0.75/$3.75 through year end, with Gemini 3.5 Pro still "coming soon" two months after it was first listed that way and Gemini 3.1 Pro plus 3.1 Deep Think as the reasoning flagships - DeepMind. Google's distinctive bet is distribution: Mariner lives inside the AI Ultra subscription and agentic features are being folded directly into Chrome and Search rather than sold as a standalone agent. Our Gemini Flash guide has the cost math for running the Flash tier as an agent workhorse.

What about Microsoft? The original article's section on it cited Fara-7B and a $30-per-seat Windows Copilot as the computer-use story, and both references have aged out. Microsoft's research line continued with the Fara-1.5 paper in June 2026, and its commercial energy has shifted toward agent orchestration across the 365 estate rather than a headline computer-use model of its own, with OpenAI models doing the heavy lifting underneath. That division of labor (Microsoft owning distribution and context, OpenAI owning the model layer) is strategically coherent, but it means Microsoft simply does not appear on the model leaderboards this guide is organized around, and readers evaluating "Microsoft's agent" are really evaluating GPT-class capability wrapped in Microsoft's harness and permissions. The same reading applies to most enterprise-software vendors shipping "agents" in 2026: the honest question is always which foundation model sits underneath and how much the wrapper adds or subtracts, a question the three-layer framing in section 11 is built to answer.

ByteDance is the lineup addition that did not exist in the original article at all, and section 9 gives it full treatment. The short version: Seed 2.1 Pro (June 24, 2026) leads the llm-stats OSWorld tracker at 0.788 while claiming roughly 80% lower total cost of ownership than the Claude Opus 4.6 class - ByteDance Seed. Combined with the open-source UI-TARS-2 line, ByteDance now fields both a frontier proprietary model and a leading open-weights GUI agent, a two-pronged position no Western lab currently matches. Alibaba joined it in August with Qwen3.8-Max, which took the OSWorld-Verified crown outright, and Meta re-entered the conversation on September 2 with Muse Spark 1.3 at 66.9% on OSWorld 2.0, up from 47.6% for the 1.2 release. Five of the eleven entries on the current OSWorld 2.0 board come from outside the Anthropic-OpenAI duopoly, which is the single clearest structural change since this guide's last edition.

7. Desktop Agents You Can Actually Buy in July 2026

Benchmarks measure models; wallets buy products. This section replaces the original article's 2025 pricing tables, most of which are now wrong in every cell, with what is actually purchasable this month. The category has matured from research previews into four distinct product shapes: the desktop agent (software that operates your own machine), the cloud agent (a hosted VM that works for you elsewhere), the subscription agent mode (agency bundled into a chatbot plan), and the agent workforce platform (multiple persistent agents with delegation and scheduling).

Claude Cowork is Anthropic's desktop agent, in research preview on Mac, Windows, and web since January 2026, included in Pro ($20/mo, or $17 billed annually) and Max ($100-200/mo) plans, with the March 2026 Computer Use preview adding full screen-vision-plus-mouse control for Pro and Max subscribers - Anthropic. Those prices have held all year, which is worth saying out loud: while per-token API pricing has churned through four generations, the consumer subscription tier bundling Cowork, Claude Code and the rest has not moved off $20 since launch - Claude pricing. It has since expanded to mobile and web with background work, scheduled tasks, and mobile approvals, rolling out to Max users first - The Decoder. The striking adoption fact remains that over 90% of usage is non-development work: file organization, research, document production, spreadsheet wrangling. Our Claude Cowork guide covers setup, plan differences, and the permission model in detail.

ChatGPT agent mode is OpenAI's equivalent, and its story is one of consolidation: the standalone Operator product died in August 2025 and agent mode inherited its Computer-Using Agent stack inside the main ChatGPT product - presenc.ai. It ships on Plus ($20/mo), Pro ($100-200/mo), and Business ($25/user/mo), and developers get the same capability via the Agents SDK computer-use tool. The pricing history of this product line is a case study in how fast this market reprices; we tracked it through the Operator era in our Operator pricing archive.

Manus repriced its entire ladder since the original article, which quoted $39 and $199 tiers that no longer exist. The current structure - manus.im/pricing: Free ($0, 300 daily refresh credits, Manus 1.6 Lite), Standard $20/mo (4,000 credits), Customizable $40/mo (8,000 credits), and Extended $200/mo (40,000 credits, Manus 1.6 Max, Wide Research, 20 concurrent tasks), with annual billing saving 17% - NoCode MBA. Manus remains the most polished cloud-VM agent for consumers, and the credit metering makes its real cost workload-dependent in a way flat subscriptions are not.

Project Mariner rounds out the table as Google's productized browser agent, available through the AI Ultra subscription and running on the dedicated Gemini 2.5 Computer Use model rather than the general chat models - Google. Its most distinctive design choice is running tasks on Google's infrastructure rather than your machine, which trades away local-context access for the ability to close your laptop while work continues. For enterprises already inside Workspace, the calculus is mostly about whether the AI Ultra bundle price amortizes across the other Gemini features it includes, because Mariner alone rarely justifies it yet.

The table hides one structural difference worth spelling out. Cowork and agent mode are one-user, one-agent experiences: you supervise a single session. Manus adds concurrency at the top tier. The workforce-platform shape, which O-mega occupies, treats agents as persistent workers with their own identities, schedules, and delegation chains, so the unit of value is a running team rather than a session. Which shape you need depends on whether you are automating a task, a workflow, or a role; prices between shapes are not directly comparable because the denominators differ.

It is also worth naming what none of these products yet do well, because the gaps are where the next twelve months of product competition will happen. None offers real cross-device continuity: a task started in a desktop agent cannot yet be seamlessly picked up by the same agent on mobile, though Cowork's background-work-plus-mobile-approvals pattern is the closest attempt. None exposes honest reliability telemetry to the buyer: you get a chat transcript, not a success-rate dashboard, which makes internal ROI cases harder to build than they should be. And every one of them prices in a different unit (seats, credits, tokens, tasks), an incommensurability that is partly immaturity and partly deliberate, since it frustrates exactly the cost-per-completed-task comparison this guide's section 5 performs on the raw models.

A buying note grounded in the benchmark sections above: every product in this table is bottlenecked by the same underlying models, so product choice is mostly about harness quality, permissions, and workflow fit rather than raw capability. A $20 subscription running Opus-class computer use will outperform a $200 product wrapped around a weaker model for your specific task if the harness fits better. Trial with your own 20-task pilot before committing budget, exactly as with the models themselves.

8. The Agentic Browser Wars

The single largest category shift since the original article is one it could not have mentioned: the agentic browser, a web browser with an agent built into the chrome itself, did not meaningfully exist in mid-2025. ChatGPT Atlas launched in October 2025 and now holds an estimated 10-15M monthly active users, posting roughly 76% agentic task-completion in comparative tests - nohacks.co. Perplexity Comet completed its cross-platform rollout with iOS in March 2026. Claude for Chrome brings Anthropic's computer-use stack to an extension, Google is folding Gemini directly into Chrome, and the open-source BrowserOS project explicitly positions itself as the open alternative to Atlas, Comet, and Dia - GitHub.

The adoption numbers deserve a sober reading, because the hype cycle around this category is intense. AI-native browsers are projected to capture only 1-3% of the global browser market in 2026 - nohacks.co. Chrome's distribution moat is not going anywhere this year. But market share measures the wrong thing: the interesting metric is what these browsers do, not how many people default to them. HUMAN Security's April 2026 State of Agentic Traffic report found that agentic browsers already generate nearly three quarters of all agentic traffic on the web - HUMAN Security. A tiny fraction of users, operating agents, now produces the dominant share of automated browsing. Every website owner, fraud team, and analytics vendor is dealing with that inversion right now.

The entrants differentiate more than the category label suggests. Atlas is the maximalist: a full Chromium-based browser where agent mode, memory of your browsing, and ChatGPT's tool ecosystem are the product, and its 10-15M MAU makes it the category's adoption leader by a wide margin. Comet leans into research and synthesis, reflecting Perplexity's search DNA, and its completed iOS rollout in March 2026 made it the first agentic browser genuinely usable across every device class. Claude for Chrome takes the opposite architectural bet: rather than replacing your browser, it instruments the one you already use, which lowers switching cost at the price of fighting Chrome's extension sandbox for capability. BrowserOS, the open-source entrant, matters less for its current polish than for what it guarantees: whatever the proprietary browsers learn about agentic UX will be reproduced in the open within months, the same diffusion dynamic playing out in models - GitHub. Nobody in this list has solved the category's core tension, which is that the more useful the agent, the more dangerous its mistakes inside an authenticated browser.

From first principles, the browser is the natural delivery vehicle for web-scoped agency: it already has your sessions, your cookies, your password manager, and your tabs, so an agent living there skips the hardest part of browser automation, which is authenticated context. That is why the category went from zero to five serious entrants in nine months. The tradeoff is equally structural: an agent with your authenticated sessions is an agent whose mistakes and injected instructions execute with your identity, which is why section 12 treats prompt injection in agentic browsers as the security story of 2026. For teams doing scaled or sensitive web automation, dedicated managed browser infrastructure with isolation still beats consumer agentic browsers; we compared that tooling layer in our stealth and managed browser guide.

How to apply this: treat agentic browsers as personal productivity endpoints, not automation infrastructure. They excel at supervised, interactive tasks (research, form filling, comparison shopping) where you watch the agent work. The moment tasks become unattended, repeated, or business-critical, you want server-side sessions, audit logs, and permission boundaries, which is the layer cloud platforms and browser-infrastructure vendors own.

9. China's Computer-Use Surge: Seed 2.1 and UI-TARS-2

The original article's landscape section was entirely Western: OpenAI, Anthropic, Google, Microsoft, and a handful of startups. The September 2026 leaderboards make that framing untenable, and the clearest single proof is that the top of OSWorld-Verified, the benchmark this entire field organized itself around, is now held by Qwen3.8-Max. Alibaba shipped it on August 3, 2026 as a 2.4-trillion-parameter mixture-of-experts model with 95B active parameters, a 1M-token context window and native text, image and video input, priced at $2/$6 per million tokens, and it posts 86.1% on OSWorld-Verified against Claude Fable 5's 85.0% - Steel.dev. Then Alibaba open-sourced a Max-class checkpoint for the first time, putting a 2.4T text model on Hugging Face in mid-August alongside an Apache-2.0 Qwen3.8-27B that itself scores 84.3% on the same board. The state of the art in desktop control is, as of this writing, something you can download.

ByteDance released Seed 2.1 Pro and Seed 2.1 Turbo on June 24, 2026 at the Volcano Engine FORCE conference, and Seed 2.1 Pro still leads the llm-stats raw OSWorld tracker at 0.788, alongside leads on MobileWorld and MMMU-Pro - ByteDance Seed. The headline that matters for buyers is economic: ByteDance positions Seed 2.1 Pro at roughly 80% lower total cost of ownership than the Claude Opus 4.6 class, per the tracker data at llm-stats.com. Even discounting vendor framing, a frontier-class GUI model at a fraction of Western pricing changes procurement math for any organization able to use it.

The open-source side is arguably more consequential. UI-TARS-2, ByteDance's multi-turn reinforcement-learning GUI agent, publishes weights and a training methodology built on RL over real GUI interaction rather than supervised imitation, and posts 47.5% on OSWorld, 50.6% on WindowsAgentArena, 73.3% on AndroidWorld, and 88.2 on Online-Mind2Web - arXiv. Those numbers trail the proprietary frontier on desktop control but beat the 2025-era proprietary systems across the board, and the Online-Mind2Web score exceeds what Anthropic's current flagship posts under comparable judging. An open-weights model that outperforms last year's closed frontier is the classic diffusion pattern this industry keeps repeating.

UI-TARS-2's training methodology is worth two sentences of technical attention because it explains the score profile. The system is trained with multi-turn reinforcement learning directly on GUI interaction trajectories, with the reward attached to task completion rather than to imitating human demonstrations, which is why it punches far above its weight on live-web tasks (where recovery behavior dominates) while trailing frontier models on OSWorld-style desktop breadth (where world knowledge about many applications dominates) - arXiv. That profile is a preview of the field's direction: as RL environments for computer use get richer, expect open models to keep closing the gap on exactly the benchmarks that reward doggedness over knowledge.

What do open-weight GUI agents mean for enterprise buyers in practice? Three things, each with a caveat. Data sovereignty: you can run UI-TARS-2 entirely inside your own network, which matters enormously for regulated workflows where shipping screenshots of internal applications to a third-party API is a non-starter; the caveat is you now own the serving stack, GPU bill, and upgrade treadmill. Cost control: self-hosted inference on reserved hardware can undercut per-token API pricing at sustained volume; the caveat is the crossover point sits at higher volume than most teams expect. Fine-tuning: open weights let you specialize the agent on your own applications, which no closed vendor currently offers for computer use; the caveat is that RL fine-tuning for GUI agents remains a research-grade skill set. For most Western enterprises the realistic 2026 posture is a hybrid: closed frontier models for the hardest long-horizon work, open or cheap models for the high-volume repetitive middle.

The geopolitical wrinkle is worth one honest paragraph. Model provenance now appears in procurement reviews, and some organizations will not deploy ByteDance-origin models regardless of scores, while others (particularly outside the US) see the pricing and openness as decisive. Both positions are rational under different constraints. What is not rational in September 2026 is the 2025 default of simply not knowing these models exist: they are at the top of the leaderboards, they are in production in large Chinese enterprises, and they set the floor for what "cheap and good enough" means globally.

10. What Died Since 2025: The Corrections Block

Refreshing a benchmark guide honestly means saying plainly which of its previous claims no longer hold. This section is that list. If you cited the 2025 version of this article, here is what to update, claim by claim.

Writer's Action Agent as the GAIA leader is over. The mid-2025 storyline had Palmyra X5 topping GAIA Level 3 at 61% and CUB at 10.4%. No 2026 leaderboard features Writer, GAIA itself is effectively saturated with leaders above 92%, and Meta superseded it with GAIA2's 800 dynamic scenarios - Hugging Face. CUB has disappeared from the benchmark conversation entirely. Operator is dead as a product. OpenAI shut the standalone version on August 31, 2025 and folded Computer-Using Agent into ChatGPT agent mode; any pricing, access, or capability claim about standalone Operator is historical - presenc.ai. The OSWorld numbers are unrecognizable. Agent S2's 34.5% state of the art became Qwen3.8-Max's 86.1% on OSWorld-Verified, well above the human baseline, with the frontier now measured on OSWorld 2.0 where the leader is Claude Fable 5.1 at 77.9%. Any 2025-era claim about desktop-agent ceilings is off by a factor of two or more.

The vendor descriptions aged just as badly. Anthropic's "100K context, no consumer agent product" became Cowork, Computer Use previews, Claude for Chrome, and 83-85% OSWorld-Verified scores. Google's "Mariner or Astra, not fully released" became a shipping Gemini 2.5 Computer Use API model powering Mariner and Search's agentic mode - Google. Microsoft's story moved from Fara-7B and $30/seat Copilot framing to the Fara-1.5 paper (June 2026) and a market conversation centered on full desktop agents rather than chat sidebars. Manus's $39/$199 tiers became $20/$40/$200 with a free tier. And Salesforce's "Agentforce 2.0, launched 2025" positioning is at least one product generation stale in a market that now benchmarks agents on OSWorld 2.0 rather than demo videos.

Why publish a corrections block at all? Because the failure mode it guards against is the industry's default: articles that quietly swap numbers while keeping their 2025 conclusions, leaving readers with a frankenstein of fresh data and stale reasoning. The conclusions changed too. In 2025, the reasonable takeaway was "agents are promising but complete a third of desktop tasks; wait or pilot narrowly." In September 2026, the defensible takeaway is "agents exceed human baselines on short-horizon computer work and complete most two-hour professional workflows on generous scoring, closer to two-fifths on strict scoring; deploy on the former, and pilot the latter with the strict number in your business case." A reader acting on the 2025 conclusion today would simply be wrong, and no amount of updated leaderboard numbers fixes that unless the advice updates with them.

11. Models vs Harnesses vs Infrastructure: The Three-Layer Stack

A distinction the 2025 article never made, and one that now determines who wins each leaderboard, is that "an AI agent" is actually three separable layers. The model layer provides perception and decision-making: Claude Opus 5, GPT-6 Astra, Gemini 3.8 Flash, Qwen3.8-Max. The harness layer wraps a model in scaffolding (planning loops, memory, retry logic, DOM access strategies): Browser Use, Agent S, GTA1, CoACT, and every vendor's proprietary agent mode. The infrastructure layer provides the environments agents run in: managed browsers, VMs, session persistence, and proxies from vendors like Steel and Browserbase. Firecrawl's mid-2026 field guide was among the first to rank the harness and infrastructure ecosystem as its own layer separate from the models - Firecrawl, and the leaderboards prove the layers matter independently: Browser Use Cloud's 97.0% on Online-Mind2Web is a harness achievement built on top of foundation models that score in the mid-80s when run raw.

The layering explains several things that look like paradoxes in flat leaderboard reading. It explains why a harness on a mid-tier model can beat a frontier model run naively: Online-Mind2Web rewards recovery strategies and DOM heuristics as much as raw intelligence. It explains why vendor benchmark revisions (section 4) are so slippery: when Anthropic "changes how it runs OSWorld-Verified," it is changing its harness, not its model, and harness improvements are real improvements even though they muddy model comparisons. And it explains where the margin lives commercially: models are being commoditized from above (frontier price cuts) and below (open weights), harnesses differentiate on reliability, and infrastructure earns steady per-session revenue regardless of which model wins the quarter.

For buyers, the layer framing converts into one practical question: which layers do you want to own? Assembling your own stack (open harness, API model, managed browser infrastructure) maximizes control and minimizes per-task cost at the price of engineering ownership. Buying a vertical product (Cowork, agent mode, Manus) minimizes setup at the price of flexibility. Platforms such as O-mega occupy the integrated-but-multi-model position: the harness and infrastructure are managed, while the model layer stays swappable as leaderboards move, which is a structural hedge against exactly the churn documented throughout this guide.

12. Security and the Agentic Traffic Explosion

Every capability gain documented above has a mirror-image risk story, and 2026 is the first year where that story has hard data instead of hypotheticals. Start with scale: HUMAN Security's April 2026 report found agentic browsers alone now generate close to 75% of all agentic traffic on the web - HUMAN Security. Agents are no longer a rounding error in traffic logs; they are the automated web. That changes the defender's problem from "detect bots" to "distinguish authorized agents acting for my users from everything else," which is a fundamentally harder classification task because the authorized agents use real browsers, real sessions, and real user credentials.

The sharpest technical risk remains prompt injection, and computer-use agents widen the aperture dramatically. A text chatbot can be injected through the conversation; a computer-use agent can be injected through anything it can see: a web page's hidden text, a PDF, an email, a calendar invite, a filename. Because agents in browsers and on desktops act with the user's authenticated identity (section 8), a successful injection does not need to exfiltrate credentials; it can simply act. The vendor mitigations are real but partial: Anthropic gates full Computer Use behind a research preview with approval prompts, ChatGPT agent mode interrupts before consequential actions, and the Fable tier ships with safety classifiers that fall back to a lower-capability model when triggered - Anthropic. Those classifiers are not free, and the September OSWorld 2.0 results quantify the cost for the first time: Anthropic notes both Fable models "took zeros on tasks where safeguards intervened," meaning the published capability score already has the safety tax subtracted from it. None of these makes injection impossible; they make it interruptible, which only helps when a human is watching.

Website owners are living the other side of this shift, and their responses will shape what agents can do next. When three quarters of agentic traffic comes through real browsers with real user sessions, the traditional bot playbook (block datacenter IPs, fingerprint headless browsers, throw CAPTCHAs) misfires against traffic that is, in a legal and often contractual sense, the user. Publishers and commerce sites are now splitting into postures: some are hardening against agents to protect ad impressions and scraping boundaries, others are publishing agent-friendly interfaces because an agent that can complete checkout is revenue. The unresolved question, being fought in robots.txt conventions, user-agent standards, and at least a few courtrooms, is whether "my agent, acting for me, with my account" inherits my access rights. However that settles, benchmark scores on live-web tests like Online-Mind2Web partially measure this social layer too: an agent's real-world success rate is capped by how much of the web decides to let agents transact at all.

For teams deploying agents on real work, the mitigations that matter are architectural rather than model-level. Run unattended agents in dedicated sessions with scoped credentials, never a human's primary identity. Keep an allowlist boundary around what domains and applications an agent can touch per task. Log every action durably enough to reconstruct what happened, because "the agent did something weird Tuesday" is now a real incident class. And treat long-horizon autonomy budgets (the 500-step runs from OSWorld 2.0) as a production risk dial, not just a benchmark parameter: more steps means more exposure surface per task. These are the boundaries agent workforce platforms enforce structurally, and they are the difference between an agent program that survives its first security review and one that gets frozen after it.

The model vendors' tiering strategies are themselves security artifacts, and reading them that way clarifies some otherwise puzzling product decisions. Anthropic splitting one underlying model into a generally available Fable 5.1 (with always-on classifiers and automatic fallback) and a restricted Mythos 5.1 (vetted partners only, under programs like Project Glasswing for cybersecurity work) is an explicit admission that peak capability and open availability no longer ship together - Anthropic. OpenAI reached the same conclusion from the other direction in September: GPT-6 Astra is the first OpenAI model to meet the Critical threshold in cybersecurity under its Preparedness Framework, which is why a flagship marketed on the line "anything you can do on a computer, Astra can do for you" launched to a limited set of organizations first, with Plus, Business and API access following behind. The most capable computer-use model of 2026 was gated on release specifically because it is good at computers. The same logic explains why full desktop Computer Use remains a research preview months after launch, and why every vendor's agent mode inserts approval friction that benchmark harnesses do not model. One consequence for readers of leaderboards: the gap between a lab's best benchmark number and what its shipped product will do on your machine is partly a safety tax, deliberately paid, and comparing a gated model's score to an open product's behavior overstates what you can actually buy.

The honest outlook is that security is currently the binding constraint on autonomy, more than capability is. The models can now complete most two-hour workflows; almost no enterprise lets them run two hours unattended. Closing that gap is less about smarter models than about the boring infrastructure of identity, isolation, and audit, which is why the infrastructure layer from section 11 is where much of the serious engineering investment is flowing in the second half of 2026.

13. What to Watch Next and How to Choose

The near-term calendar is unusually concrete, and the last edition's calendar is a useful check on how fast these predictions resolve. GPT-5.6 Sol, Terra and Luna did launch on July 9, 2026, and their prices settled below the preview rates, at $4/$20, $2/$12 and $0.20/$1.20 - OpenAI. Luna at twenty cents per million input tokens did exactly what we said it would: it put frontier-adjacent agency below every price point in the previous edition of this guide. Gemini 3.5 Pro is still officially "coming soon," now above a 3.8-generation Flash - DeepMind, which is its own kind of signal about where Google's attention actually went. On Anthropic's side the question remains access rather than existence: Claude Mythos 5.1 leads its stack on Terminal-Bench 4.0 at 60.9% but stays restricted to vetted partners, so watch for the widening of that tier. The thing genuinely worth watching now is whether OpenAI opens GPT-6 Astra past its enterprise-first rollout, because a Critical-cyber-rated model with the fastest per-task computer-use times in the field is the first case where the gating decision, not the capability, sets the market.

Beyond the model calendar, three slower-moving developments will matter more by year end than any single launch. OSWorld 2.0 results are now everywhere in marketing, and the numbers cleared 30% and kept going within ten weeks; remember from section 4 that a number means nothing without its scoring setting, task release, step budget and harness disclosure attached, and that the same model legitimately reads 77.9% or 41.7% depending on which of those you pick. GAIA2-style dynamic evaluation will spread into enterprise procurement, because static task lists systematically overstate reliability for ambient, interruption-heavy work, and buyers are noticing. And the judge-methodology fight on live-web benchmarks will get resolved or get worse: either the community standardizes on auditable judging for Online-Mind2Web-class tests, or self-judged 99% claims proliferate until the benchmark loses its authority the way unaudited GAIA claims did in 2025. Which way that goes determines whether the next edition of this guide can still cite a single live-web number with a straight face.

The durable way to choose, extracted from everything above, is a three-question framework. First, what horizon is your work? Short-horizon, repetitive web and desktop tasks are a solved procurement problem: pick on price and integration, because everything frontier-class clears the bar. Long-horizon professional workflows are frontier territory: only the Opus-class completion rates matter, the token bill is justified against human hourly cost, and you should pilot with explicit step budgets. Second, which layers do you want to own? Buy a vertical product for personal and small-team productivity; assemble or adopt a platform when agents become roles rather than sessions. Third, what does your security posture permit? Attended agency is deployable everywhere today; unattended agency is an infrastructure project, and vendors who hand-wave the identity and audit questions are selling you your next incident.

To make the framework concrete, walk three representative buyers through it. A solo professional automating research, drafting, and admin should buy a vertical product today: Claude Cowork or ChatGPT agent mode at $20 per month clears the short-horizon bar, the attended-use security model matches how they will actually work, and no math in section 5 justifies API plumbing at one-user scale. A five-person operations team with recurring web workflows sits at the layer-ownership decision: a harness like Browser Use on managed browser infrastructure, or an agent workforce platform if the workflows need scheduling, delegation, and durable identities rather than ad-hoc runs. A regulated enterprise should start from the security question and work backward: scoped credentials and audit infrastructure first, an attended pilot on OSWorld-2.0-class workflows second, and model selection last, because by the time governance is ready, the leaderboard will have changed anyway and the routed multi-model posture will absorb whatever it says.

Benchmark literacy is the meta-skill underneath all three questions. The numbers in this guide will age; the reading habits should not. Check the date on every score. Check whether it is OSWorld or OSWorld-Verified or OSWorld 2.0, and if it is OSWorld 2.0, which task release and whether the setting is partial or strict. Check the judge on every live-web claim. Check the step and token budget on every long-horizon result. And check whether a vendor's comparison chart mixes its own revised harness numbers with competitors' older ones, because after Anthropic's own retroactive revision of Opus 4.7's score, that failure mode is documented at the top of the market, not the bottom.

This guide is maintained by the team at O-mega, where AI agent workforces run browser and computer sessions against exactly these tradeoffs daily. It was written by Yuma Heymans (@yumahey), O-mega's founder, who spends an unreasonable fraction of his week rerunning these benchmarks' claims against live agent sessions before letting any of them steer the platform's model routing.

This guide reflects the computer-use benchmark landscape as of September 8, 2026. Scores, prices, and product availability in this field change monthly (three frontier models shipped in the week before this update). Verify current numbers against the linked primary sources before making purchasing decisions.