AI Computer Use Benchmarks 2026: Top Agents Ranked

The July 2026 field guide to computer-use benchmarks, the agents that top them, and what the leaderboard numbers actually mean for your work

AI agents went from completing 34.5% of real desktop tasks to 85.4% in roughly fourteen months, blowing past the ~72% human baseline on the field's flagship benchmark. Then, on June 26, 2026, the same research lab that built that benchmark released a harder one, and the best model in the world dropped back to 20.6% - OSWorld 2.0. That whiplash, from saturation to humility in a single release cycle, is the defining story of computer-use AI in 2026, and it is why almost everything written about agent benchmarks in 2025 is now dangerously out of date.

This guide was originally published as a 2025 benchmark overview. We have rewritten it top to bottom for the July 2026 landscape, because the field did not just move, it inverted. The 2025 storylines (Writer's Action Agent topping GAIA, OpenAI's Operator as a standalone research preview, OSWorld state of the art sitting in the low thirties) are all dead. In their place: OSWorld-Verified as the standard citation, OSWorld 2.0 as the new frontier, Online-Mind2Web as the live-web standard, an entire agentic browser category that did not exist when the original article was written, and a wave of Chinese open-weight GUI agents that now sit on top of several trackers.

What you will get here: the current leaderboards with dates and sources, a ranked assessment of the top computer-use agents you can actually run today, the token-economics math nobody else publishes (what a completed long-horizon task actually costs in dollars), an honest section on why vendor benchmark numbers are not comparable, and a corrections block that names what died since 2025. Platforms like O-mega sit downstream of all of this: when you run an AI workforce that operates browsers and computers for you, the question "which agent actually completes tasks, at what cost" stops being academic. This guide answers it with July 2026 data.

Contents

1. What Changed Since 2025: From Saturation to OSWorld 2.0
2. The July 2026 Scoreboard: Who Leads Each Benchmark
3. The Benchmark Canon in 2026: What to Cite and What to Ignore
4. Benchmark Integrity: Why the Numbers Are Not Comparable
5. Token Economics: What a Completed Task Actually Costs
6. The Model Lineup: Anthropic, OpenAI, Google, ByteDance
7. Desktop Agents You Can Actually Buy in July 2026
8. The Agentic Browser Wars
9. China's Computer-Use Surge: Seed 2.1 and UI-TARS-2
10. What Died Since 2025: The Corrections Block
11. Models vs Harnesses vs Infrastructure: The Three-Layer Stack
12. Security and the Agentic Traffic Explosion
13. What to Watch Next and How to Choose

The July 2026 Assessment: Top Computer-Use Agents Ranked

Before the deep dives, here is the master table. We scored the eight most important computer-use systems of July 2026 on four criteria: OS-level control (30%, anchored on OSWorld-Verified and OSWorld 2.0 results), live-web agency (25%, anchored on Online-Mind2Web and real-website task completion), cost per completed task (25%, derived from current API pricing and measured token consumption), and access and ecosystem (20%, how easily you can actually deploy it today). Every cell contains the score and the reason for it.

Two readings of this table matter more than the ranking itself. First, the top two are separated by one tenth of a point but represent opposite philosophies: Claude Opus 4.8 buys maximum task completion with enormous token budgets, while GPT-5.5 buys efficiency and plateaus earlier. Which one "wins" depends entirely on whether your task must be finished or must be cheap, a tradeoff we quantify in dollars in section 5. Second, the presence of Seed 2.1 Pro and UI-TARS-2 in the top six would have been unthinkable in the 2025 version of this article, which did not mention a single Chinese lab. The July 2026 leaderboards do not permit that omission anymore.

1. What Changed Since 2025: From Saturation to OSWorld 2.0

The single most important fact in this entire guide is a narrative arc, not a number. In mid-2025, the state of the art on OSWorld, the benchmark that measures whether an AI can operate a real Ubuntu desktop (files, browsers, office apps, system settings), was 34.5%, held by Simular's Agent S2, with OpenAI's computer-use models around 32.6% on the 50-step split. The original version of this article reported those numbers as the frontier. Fourteen months later, the Steel.dev cross-benchmark leaderboard shows Claude Mythos Preview at 85.4% on OSWorld-Verified with Claude Fable 5 at 85.0%, both comfortably above the ~72% human baseline that the benchmark's own authors measured. Agents did not just improve. On this specific test, they became better than the people the test was calibrated against.

The XLANG Lab, which maintains OSWorld, said the quiet part out loud: agents scoring 83.5% does not mean the problem is solved, it means the benchmark stopped measuring the problem - OSWorld-V2 on GitHub. Their response, released June 26, 2026, is OSWorld 2.0 (also written OSWorld-V2): 108 long-horizon workflows across seven professional domains, with a median human completion time of roughly 1.6 hours per task. Where OSWorld 1.0 tasks averaged about 30 tool calls, OSWorld 2.0 tasks average 318 tool calls when run with Claude Opus 4.7 at maximum thinking budget. These are not "change the wallpaper and save a file" tasks. They are "reconcile this dataset across three applications, produce the report, and fix what breaks along the way" tasks.

The scores reset accordingly. On OSWorld 2.0, Claude Opus 4.8 completes 20.6% of tasks at a 500-step budget, consuming about 244K output tokens per task in the process. Claude Opus 4.7 reaches 18.2%. GPT-5.5 plateaus near 13-14% while spending only about 39K output tokens - OSWorld 2.0. The benchmark authors also published where agents break: cross-source reasoning appears in 42.6% of tasks, visual-spatial precision in 41.7%, implicit-state inference and multi-item state tracking in 39.8% each, and the single most damaging failure mode is the recovery and maintenance of hidden state, the context a human keeps in their head across a two-hour workflow.

It is worth pausing on why saturation happened this fast, because the mechanism predicts what happens next. Three forces compounded. Verified environments removed noise: once OSWorld-Verified fixed its 300+ broken tasks and standardized infrastructure, labs could optimize against a stable target instead of chasing evaluation artifacts. Reinforcement learning on real GUI interaction replaced supervised imitation as the dominant training recipe, a shift visible in everything from Anthropic's agentic training disclosures to ByteDance's UI-TARS-2 paper, and RL is exactly the technique that converts a stable target into rapid score growth. And 50x parallel evaluation collapsed the iteration loop from days to hours, so every experiment cycle got cheaper at the same moment the training signal got stronger. The same three forces are now pointed at OSWorld 2.0, which is why nobody serious expects its 20.6% frontier to hold through the winter.

The seven professional domains in OSWorld 2.0 also deserve a mention, because they define what "long-horizon" means concretely: the workflows span office productivity, data work, professional creative tools, and system administration, with tasks routinely requiring the agent to move outputs between applications and to notice when an earlier step silently failed. The median 1.6-hour human completion time is the tell - osworld-v2.xlang.ai. These are tasks you would assign to a junior colleague with a written brief, not tasks you would dictate to an assistant sentence by sentence. That is the bar the field has decided to measure itself against for the next cycle, and it is the right bar, because it is the one that maps to actual jobs rather than isolated actions.

Why this matters practically: if you evaluated an agent vendor in 2025 and walked away unimpressed, your data is stale in the specific direction of underestimating the field. If you are reading a vendor's deck in July 2026 that quotes "85% on OSWorld," you now know that number describes a saturated test that the research community has already replaced. The honest one-line summary of the field is this: short-horizon computer use is largely solved at the frontier, and long-horizon computer use is roughly 20% solved. Both halves of that sentence are new since 2025, and every buying decision should be made with both in mind. For a deeper look at how the current Anthropic frontier models behave on these workloads, see our Claude Opus 4.8 benchmark guide.

2. The July 2026 Scoreboard: Who Leads Each Benchmark

Numbers in this field rot fast, so every score in this section carries its date and source. The anchor benchmark for desktop control remains OSWorld-Verified, the cleaned-up AWS-hosted successor to raw OSWorld that XLANG introduced on July 28, 2025, fixing over 300 task issues and enabling 50x parallel evaluation - xlang.ai. When someone cites "OSWorld" in 2026 without the "Verified" qualifier, ask which one they mean; the numbers differ, and section 4 explains why that matters.

The top of that chart is an Anthropic sweep: Claude Mythos Preview at 85.4%, Claude Fable 5 at 85.0%, Claude Opus 4.8 at 83.4%, and Claude Opus 4.7 at a retroactively revised 82.3% - Steel.dev. OpenAI's GPT-5.5 posts 78.7% and Google's Gemini 3.5 Flash 78.4%, per DeepMind's own model page. Note what the human baseline sitting at the bottom of the chart implies: on short-horizon desktop tasks, every frontier model now outperforms the average human tester. That is precisely the condition under which a benchmark stops discriminating and the field needs a new one.

The new one tells a different story. On OSWorld 2.0, the same models compress into a low, tight band, and the gap between "best" and "second best" is measured in single digits with wildly different resource consumption. The grouped comparison below is, in our view, the single most informative chart in computer-use AI right now, because it shows saturation and frontier side by side.

On the live web, the standard has consolidated around Online-Mind2Web: 300 tasks across 136 real, live websites, difficulty-tiered from Easy (1-5 steps) through Hard (11+ steps) - Browser Use. The current leader is Browser Use Cloud (bu-max) at 97.0%, a specialized browser-agent harness rather than a raw model - Steel.dev Online-Mind2Web leaderboard. For historical contrast: the systems that defined early 2025, the Claude 3.7-era Computer Use stack and OpenAI's Operator, scored around 61% on the same benchmark. Anthropic's current models score around 84% per Browserbase's evaluation of Claude Opus 4.8, and ByteDance's open-source UI-TARS-2 posts 88.2 - arXiv.

Beyond those two anchors, the July 2026 state of the rest of the canon, per the Steel.dev cross-benchmark leaderboard updated June 29, 2026: WebVoyager is led by Alumnium at 98.5% (saturated), WebArena by WebTactix running DeepSeek v3.2 at 74.3%, GAIA by OPS-Agentic-Search at 92.36% (effectively saturated and superseded by GAIA2), SWE-bench Verified by Claude Mythos 5 at 95.5%, tau-bench by Step-3.5-Flash at 88.2%, and BrowseComp by GPT-5.5 Pro at 90.1%. On the terminal side, Terminal-Bench 2.1 at tbench.ai is the citation both Anthropic and Google use in their model cards, with Claude Opus 4.8 edging GPT-5.5's 83.4% there per Vellum's benchmark breakdown. We maintain a broader cross-model snapshot in our AI model benchmarks and pricing guide if you want the non-agentic numbers too.

Terminal-Bench merits a short aside because it measures the one computer-use surface where agents were already strong before the GUI wave: the command line. Terminal work is text-native, deterministic, and verifiable, which is why agent scores there (83.4% for the leaders) run well ahead of GUI long-horizon results, and why teams automating infrastructure get production value from agents today that teams automating GUI-only legacy software cannot yet match. The strategic implication cuts both ways: if a workflow can be moved from a GUI to a scriptable interface, its automation ceiling jumps immediately, and the highest-ROI "agent project" in many organizations is actually an API-enablement project wearing a different name.

Reading that scatter of names correctly requires knowing which of these boards still discriminate. WebVoyager at 98.5% is a solved test; its residual 1.5% is mostly ambiguous task definitions, so treat any vendor still leading with a WebVoyager number as decorating rather than informing. WebArena's 74.3% ceiling looks unsaturated, but the leader runs an open-weight DeepSeek v3.2 under a specialized harness, which says more about the harness layer (section 11) than about frontier models, most of which do not bother submitting. GAIA's 92.36% leader is an agentic-search specialist, and the benchmark's authors have effectively moved on to GAIA2, whose dynamic scenarios reset the difficulty the same way OSWorld 2.0 did for desktops. The pattern across all of them is identical and worth internalizing: every static agent benchmark introduced before 2025 is now either saturated or led by specialists, and the informative frontier lives on the 2026 generation of tests. A practical corollary for anyone commissioning agent work: ask vendors for numbers on OSWorld 2.0, Online-Mind2Web, GAIA2, and Terminal-Bench 2.1 specifically, and treat silence on all four as a signal in itself.

3. The Benchmark Canon in 2026: What to Cite and What to Ignore

Benchmarks are not neutral instruments. Each one embodies a theory of what "using a computer" means, and picking the wrong one for your use case will steer you to the wrong agent. The 2026 canon has consolidated hard since the sprawling benchmark zoo of 2025, and understanding what each test actually measures is the fastest way to read any vendor claim critically. This section walks through the tests worth citing today, in descending order of how often they should appear in your evaluations.

OSWorld-Verified is the default citation for desktop control. It runs agents against a real Ubuntu VM performing real application tasks, and since the July 2025 migration to AWS with 50x parallelization and 300+ task fixes, results are reproducible enough that labs stake launch claims on it - xlang.ai. Its weakness is now well documented: it is saturated. Scores above the ~72% human baseline cluster within a few points of each other, and differences up there tell you more about harness tuning than model capability. OSWorld 2.0 fixes exactly that with 108 long-horizon professional workflows averaging 318 tool calls, and it should be your primary reference whenever the workload you care about takes a human more than a few minutes - osworld-v2.xlang.ai. A vendor that quotes OSWorld-Verified but goes quiet on OSWorld 2.0 is telling you something.

For web work, Online-Mind2Web replaced the older static datasets because it runs on 136 live websites rather than cached snapshots, which means agents face real popups, real layout changes, and real anti-bot friction - Browser Use. WebVoyager and WebArena still appear in papers, but WebVoyager's 98.5% ceiling makes it a sanity check rather than a differentiator, and WebArena's simulated sites reward memorization of a fixed environment. For general assistant-style agency, GAIA2 superseded GAIA: 800 scenarios running inside Meta's Agents Research Environments with asynchronous dynamic events, continuous time, and capability splits for execution, search, adaptability, temporal reasoning, and ambiguity handling - Hugging Face leaderboard. The dynamic-events design matters: GAIA2 scenarios change while the agent works, which is much closer to a real inbox than a frozen question set.

Two more deserve a place in your reading list. Terminal-Bench 2.1 measures command-line agency (builds, scripts, system administration) and has become the shared citation across Anthropic and Google model cards - tbench.ai. And tau-bench measures tool-use reliability in conversational customer-service settings, where the current leader is Step-3.5-Flash at 88.2% - Steel.dev. What should you ignore? Anything that was a headline in mid-2025 and has no 2026 leaderboard activity: CUB has effectively vanished from the conversation, the 15-step and 50-step OSWorld splits are obsolete now that Verified standardized the protocol, and single-number "agent IQ" composites remain marketing. If you are building agents yourself rather than buying them, our insider guide to building AI agents covers how these benchmarks translate into architecture decisions.

GAIA2's design deserves one more paragraph, because it introduces a measurement idea the rest of the canon lacks: capability splits. Instead of a single success rate, the leaderboard reports separate scores for execution, search, adaptability, time handling, and ambiguity handling, run inside Meta's Agents Research Environments where events fire asynchronously while the agent works - Hugging Face. The splits matter because they expose failure shapes that aggregate numbers hide: an agent can be excellent at executing clear instructions and terrible at noticing that the situation changed mid-task, and those are different products even when their averages match. Expect the split-score idea to spread; OSWorld 2.0's published failure-phenomenon percentages (cross-source reasoning, hidden state, visual precision) are the same instinct applied to desktops, and both are far more useful to a buyer than a leaderboard rank.

The practical way to apply this canon: match the benchmark to the horizon of your workload. Short repetitive web tasks map to Online-Mind2Web. Desktop application work maps to OSWorld-Verified for a floor and OSWorld 2.0 for a ceiling. Ambient assistant duties map to GAIA2. Infrastructure and DevOps map to Terminal-Bench 2.1. No single number summarizes an agent, and any vendor who gives you one anyway has chosen the number that flatters them.

4. Benchmark Integrity: Why the Numbers Are Not Comparable

Here is the section most benchmark roundups will not write, because it complicates every clean table including ours. The uncomfortable truth of July 2026 is that agent benchmark scores are not directly comparable across vendors, releases, or even months, and there are three specific, documented mechanisms behind that.

First, vendors change their own evaluation harnesses. When Anthropic launched Claude Opus 4.8, it also changed how it runs the OSWorld-Verified evaluation "to better reflect real-world performance" and retroactively revised Claude Opus 4.7's score to 82.3% - Vellum. The model did not change. The number did. That is a defensible methodology decision and Anthropic disclosed it, but it means a 4.7 score you read in a February article and a 4.7 score you read in a June article are different measurements wearing the same name. Every cross-release comparison chart you see, including the ones in this guide, inherits that caveat.

Second, the judge changes the score. Online-Mind2Web results depend heavily on who or what decides a task "succeeded": human evaluation, the automated WebJudge, and custom vendor-built agentic judges produce materially different results for the same agent on the same tasks. One vendor, Aside, self-reports 99.3% (297 of 299 tasks) using its own judging methodology - aside-benchmarks on GitHub. That number may be honest work, but it is not comparable to the 97.0% that Browser Use posts under the leaderboard's standard judge, and neither is comparable to a human-judged 84%. When you see a live-web score, your first question should be "judged by what?"

Third, step budgets and token budgets are silently load-bearing. Claude Opus 4.8's 20.6% on OSWorld 2.0 is a 500-step number achieved with roughly 244K output tokens per task; GPT-5.5's ~13.5% comes with a ~39K-token footprint - osworld-v2.xlang.ai. Cap both models at a small budget and the ranking flips: XLANG's own analysis shows small budgets favor GPT-5.5 while maximizing completion favors Opus. A leaderboard that publishes success rates without budgets is publishing half a measurement.

There is a fourth mechanism that no single scandal illustrates but that quietly distorts every saturated benchmark: optimization pressure. Once a benchmark becomes the industry's shared scoreboard, every lab's training and harness decisions get tuned against it, directly or indirectly, and the score stops being a random sample of capability and becomes the target of it. This is Goodhart's law operating at industrial scale, and it is the structural reason saturated benchmarks overstate general capability: the 85% club on OSWorld-Verified is partly "models got better at computers" and partly "models got better at OSWorld-shaped tasks." OSWorld 2.0's early numbers are more trustworthy precisely because nobody has had time to overfit them yet, which is also why those numbers will become gradually less trustworthy as the benchmark ages. Fresh benchmarks are not just harder; they are epistemically cleaner, and their cleanliness decays on a schedule you can roughly predict from lab attention.

What should a buyer do with this? Not despair, but triangulate. Trust directionally consistent results across independent harnesses (Anthropic's OSWorld-Verified lead shows up on Steel.dev, in Browserbase's Online-Mind2Web testing, and in third-party writeups, so it is probably real). Distrust any single-source record, especially self-judged ones. Prefer leaderboards that publish their harness code and judge methodology, which is exactly why Steel.dev and the official OSWorld and GAIA2 boards have become the field's reference points. And when the stakes are real, run a 20-task pilot on your own workload, because your workflows are a benchmark no lab has ever seen. This is the approach we take internally at O-mega when selecting models for browser and computer sessions, and it regularly contradicts at least one published number.

5. Token Economics: What a Completed Task Actually Costs

Benchmark coverage in 2026 still mostly stops at success rates. But the OSWorld 2.0 results published enough resource data to do something more useful: compute the dollar cost of a completed long-horizon task, and the answer reshapes the "which model is best" question into "which model is best at what price."

Start with the raw inputs. Claude Opus 4.8 is priced at $5 per million input tokens and $25 per million output tokens, with a fast mode at $10/$50 - Anthropic. GPT-5.5 is priced at $5/$30 with a 1M-token context window, and GPT-5.5 Pro at $30/$180 - tech-insider.org. On OSWorld 2.0 at a 500-step budget, Opus 4.8 consumes about 244K output tokens per task attempt and completes 20.6% of tasks; GPT-5.5 consumes about 39K output tokens and completes roughly 13.5%.

Now the arithmetic. Opus 4.8's output-token bill per attempt is 244,000 x $25 per million, or about $6.10. Divide by the 20.6% completion rate and the output-token cost per completed task is roughly $29.60. GPT-5.5's attempt costs about 39,000 x $30 per million, or $1.17, and dividing by 13.5% gives roughly $8.70 per completed task. Two caveats keep this honest: these are output-token floors (input tokens, which include repeated screenshots in computer-use loops, typically dominate the real bill and are not broken out per task in the public data), and failed attempts in production often get retried by different strategies rather than simply re-rolled. But the shape of the conclusion survives both caveats: GPT-5.5 completes long-horizon tasks at roughly one third of Opus 4.8's token cost, while Opus completes roughly half again as many tasks overall.

The strategic reading is the important part. If your workload consists of tasks that both models can do, GPT-5.5 is the economically rational default, and the plateau does not hurt you. But GPT-5.5's curve flattens near 13-14% regardless of additional steps, which means there is a band of harder tasks (roughly a third of what Opus completes) that no amount of GPT-5.5 spend currently reaches. For those tasks, Opus 4.8's premium is not a premium at all; it is the difference between done and not done, and the comparison price is not $8.70 but the hourly cost of the human who otherwise does a 1.6-hour workflow. At a loaded cost of even $50 per hour, the human comparison price is $80, which makes $29.60 in tokens look cheap. This is the calculation that agent platforms make on your behalf: at O-mega, routing logic exists precisely because the answer to "which model" changes per task, and pinning everything to one vendor leaves either capability or money on the table.

Scale the arithmetic up and the strategic stakes get clearer. Suppose an operations team wants to automate 1,000 long-horizon workflows per month, of the OSWorld 2.0 difficulty class. On the output-token floor alone, an Opus-4.8-only strategy prices at roughly $29,600 per month of completed work plus the cost of the ~79% of attempts that fail and need human pickup; a GPT-5.5-only strategy prices at roughly $8,700 for the subset it can complete and silently forfeits the harder third of the portfolio. A routed strategy (cheap model first, escalate failures to the expensive one) dominates both, which is not a novel insight in distributed systems but is strangely absent from most agent procurement conversations, where "pick a model" is still treated as a single decision. The other lever the raw math hides is prompt caching: computer-use loops resend large, mostly identical context (system prompts, tool definitions, screenshot histories), and cached input pricing changes the input side of the bill by multiples. Vendors' caching discounts differ enough that the cheapest model per token and the cheapest model per cached agent-loop are not always the same model.

One more wrinkle worth pricing in: premium model tiers. Claude Fable 5 and Claude Mythos 5, both released June 9, 2026 at $10/$50 per million tokens, are the same underlying model with different deployment guardrails, and Fable 5's 85.0% OSWorld-Verified comes at exactly double Opus 4.8's token price - Anthropic. On a saturated benchmark, paying 2x for 1.6 points is rarely rational; on your hardest live workflows, it sometimes is. We break the Fable and Mythos tier down further in our Claude Fable 5 and Mythos 5 benchmark guide.

6. The Model Lineup: Anthropic, OpenAI, Google, ByteDance

The 2025 version of this article described a field of research previews and experimental betas. The July 2026 field is a settled four-way race between shipping products, so this section profiles each lab's actual current lineup, with the stale claims from the original article explicitly corrected.

Anthropic has the strongest computer-use portfolio on paper and on leaderboards. The original article described Anthropic as having a 100K-token context window and "no standalone consumer agent product." Both claims are now absurd. Claude Opus 4.8, released May 28, 2026, posts 83.4% on OSWorld-Verified, roughly 84% on Online-Mind2Web per Browserbase, and beats GPT-5.5 on Terminal-Bench 2.1 - Anthropic. Above it sit Claude Fable 5 (generally available, safety classifiers with fallback to Opus 4.8) and Claude Mythos 5 (restricted to vetted partners under programs like Project Glasswing for cybersecurity and trusted biomedical access) - Anthropic. On the product side, Claude Cowork launched January 12, 2026 as a general desktop agent, and Simon Willison's early analysis noted that over 90% of Cowork usage is not software development - simonwillison.net. Full desktop control (screen vision plus virtual mouse and keyboard) arrived in research preview on March 23-24, 2026 for Pro and Max subscribers - CNBC. The restricted Mythos tier is worth watching separately; our Claude Mythos Preview insider guide tracks what its 85.4% OSWorld-Verified entry signals about the next general release.

OpenAI consolidated rather than fragmented. The original article's framing ("Operator and Deep Research, experimental betas based on GPT-4-era models") is two product generations gone: standalone Operator was shut down August 31, 2025, and its Computer-Using Agent capabilities were absorbed into ChatGPT agent mode, announced July 17, 2025 and available today on Plus at $20/mo, Pro at $100-200/mo, and Business at $25 per user per month, plus a computer-use tool in the Agents SDK - presenc.ai tracker. The current model is GPT-5.5 (April 23, 2026), whose 78.7% OSWorld-Verified and 83.4% Terminal-Bench 2.1 come with the best token efficiency in the frontier class, and whose 1M-token context window matters more for long agent sessions than headline benchmarks suggest. The GPT-5.6 family (Sol, Terra, Luna) was announced June 26, 2026 with public launch on July 9, 2026, at preview pricing of $5/$30, $2.50/$15, and $1/$6 respectively - coursiv.io. We published a full GPT-5.6 benchmark and pricing breakdown as the launch data landed, and our GPT-5.5 complete guide covers the current flagship in depth.

Google finally shipped the things the 2025 article said were "not fully released." The dedicated Gemini 2.5 Computer Use model exposes browser and UI control through the API and powers Project Mariner, the Firebase Testing Agent, and agentic capabilities in AI Mode in Search - Google. The current general lineup puts Gemini 3.5 Flash at 78.4% OSWorld-Verified, 76.2% Terminal-Bench 2.1, and 83.6% on MCP Atlas, with Gemini 3.5 Pro "coming soon" and Gemini 3.1 Pro plus 3.1 Deep Think as the reasoning flagships - DeepMind. Google's distinctive bet is distribution: Mariner lives inside the AI Ultra subscription and agentic features are being folded directly into Chrome and Search rather than sold as a standalone agent. Our Gemini 3.5 Flash guide has the cost math for running it as an agent workhorse.

What about Microsoft? The original article's section on it cited Fara-7B and a $30-per-seat Windows Copilot as the computer-use story, and both references have aged out. Microsoft's research line continued with the Fara-1.5 paper in June 2026, and its commercial energy has shifted toward agent orchestration across the 365 estate rather than a headline computer-use model of its own, with OpenAI models doing the heavy lifting underneath. That division of labor (Microsoft owning distribution and context, OpenAI owning the model layer) is strategically coherent, but it means Microsoft simply does not appear on the model leaderboards this guide is organized around, and readers evaluating "Microsoft's agent" are really evaluating GPT-5.5-class capability wrapped in Microsoft's harness and permissions. The same reading applies to most enterprise-software vendors shipping "agents" in 2026: the honest question is always which foundation model sits underneath and how much the wrapper adds or subtracts, a question the three-layer framing in section 11 is built to answer.

ByteDance is the lineup addition that did not exist in the original article at all, and section 9 gives it full treatment. The short version: Seed 2.1 Pro (June 24, 2026) leads the llm-stats OSWorld tracker at 0.788 while claiming roughly 80% lower total cost of ownership than the Claude Opus 4.6 class - ByteDance Seed. Combined with the open-source UI-TARS-2 line, ByteDance now fields both a frontier proprietary model and the strongest open-weights GUI agent, a two-pronged position no Western lab currently matches.

7. Desktop Agents You Can Actually Buy in July 2026

Benchmarks measure models; wallets buy products. This section replaces the original article's 2025 pricing tables, most of which are now wrong in every cell, with what is actually purchasable this month. The category has matured from research previews into four distinct product shapes: the desktop agent (software that operates your own machine), the cloud agent (a hosted VM that works for you elsewhere), the subscription agent mode (agency bundled into a chatbot plan), and the agent workforce platform (multiple persistent agents with delegation and scheduling).

Claude Cowork is Anthropic's desktop agent, in research preview on Mac, Windows, and web since January 2026, included in Pro ($20/mo) and Max ($100-200/mo) plans, with the March 2026 Computer Use preview adding full screen-vision-plus-mouse control for Pro and Max subscribers - Anthropic. It has since expanded to mobile and web with background work, scheduled tasks, and mobile approvals, rolling out to Max users first - The Decoder. The striking adoption fact remains that over 90% of usage is non-development work: file organization, research, document production, spreadsheet wrangling. Our Claude Cowork guide covers setup, plan differences, and the permission model in detail.

ChatGPT agent mode is OpenAI's equivalent, and its story is one of consolidation: the standalone Operator product died in August 2025 and agent mode inherited its Computer-Using Agent stack inside the main ChatGPT product - presenc.ai. It ships on Plus ($20/mo), Pro ($100-200/mo), and Business ($25/user/mo), and developers get the same capability via the Agents SDK computer-use tool. The pricing history of this product line is a case study in how fast this market reprices; we tracked it through the Operator era in our Operator pricing archive.

Manus repriced its entire ladder since the original article, which quoted $39 and $199 tiers that no longer exist. The current structure - manus.im/pricing: Free ($0, 300 daily refresh credits, Manus 1.6 Lite), Standard $20/mo (4,000 credits), Customizable $40/mo (8,000 credits), and Extended $200/mo (40,000 credits, Manus 1.6 Max, Wide Research, 20 concurrent tasks), with annual billing saving 17% - NoCode MBA. Manus remains the most polished cloud-VM agent for consumers, and the credit metering makes its real cost workload-dependent in a way flat subscriptions are not.

Project Mariner rounds out the table as Google's productized browser agent, available through the AI Ultra subscription and running on the dedicated Gemini 2.5 Computer Use model rather than the general chat models - Google. Its most distinctive design choice is running tasks on Google's infrastructure rather than your machine, which trades away local-context access for the ability to close your laptop while work continues. For enterprises already inside Workspace, the calculus is mostly about whether the AI Ultra bundle price amortizes across the other Gemini features it includes, because Mariner alone rarely justifies it yet.

The table hides one structural difference worth spelling out. Cowork and agent mode are one-user, one-agent experiences: you supervise a single session. Manus adds concurrency at the top tier. The workforce-platform shape, which O-mega occupies, treats agents as persistent workers with their own identities, schedules, and delegation chains, so the unit of value is a running team rather than a session. Which shape you need depends on whether you are automating a task, a workflow, or a role; prices between shapes are not directly comparable because the denominators differ.

It is also worth naming what none of these products yet do well, because the gaps are where the next twelve months of product competition will happen. None offers real cross-device continuity: a task started in a desktop agent cannot yet be seamlessly picked up by the same agent on mobile, though Cowork's background-work-plus-mobile-approvals pattern is the closest attempt. None exposes honest reliability telemetry to the buyer: you get a chat transcript, not a success-rate dashboard, which makes internal ROI cases harder to build than they should be. And every one of them prices in a different unit (seats, credits, tokens, tasks), an incommensurability that is partly immaturity and partly deliberate, since it frustrates exactly the cost-per-completed-task comparison this guide's section 5 performs on the raw models.

A buying note grounded in the benchmark sections above: every product in this table is bottlenecked by the same underlying models, so product choice is mostly about harness quality, permissions, and workflow fit rather than raw capability. A $20 subscription running Opus-class computer use will outperform a $200 product wrapped around a weaker model for your specific task if the harness fits better. Trial with your own 20-task pilot before committing budget, exactly as with the models themselves.

8. The Agentic Browser Wars

The single largest category shift since the original article is one it could not have mentioned: the agentic browser, a web browser with an agent built into the chrome itself, did not meaningfully exist in mid-2025. ChatGPT Atlas launched in October 2025 and now holds an estimated 10-15M monthly active users, posting roughly 76% agentic task-completion in comparative tests - nohacks.co. Perplexity Comet completed its cross-platform rollout with iOS in March 2026. Claude for Chrome brings Anthropic's computer-use stack to an extension, Google is folding Gemini directly into Chrome, and the open-source BrowserOS project explicitly positions itself as the open alternative to Atlas, Comet, and Dia - GitHub.

The adoption numbers deserve a sober reading, because the hype cycle around this category is intense. AI-native browsers are projected to capture only 1-3% of the global browser market in 2026 - nohacks.co. Chrome's distribution moat is not going anywhere this year. But market share measures the wrong thing: the interesting metric is what these browsers do, not how many people default to them. HUMAN Security's April 2026 State of Agentic Traffic report found that agentic browsers already generate nearly three quarters of all agentic traffic on the web - HUMAN Security. A tiny fraction of users, operating agents, now produces the dominant share of automated browsing. Every website owner, fraud team, and analytics vendor is dealing with that inversion right now.

The entrants differentiate more than the category label suggests. Atlas is the maximalist: a full Chromium-based browser where agent mode, memory of your browsing, and ChatGPT's tool ecosystem are the product, and its 10-15M MAU makes it the category's adoption leader by a wide margin. Comet leans into research and synthesis, reflecting Perplexity's search DNA, and its completed iOS rollout in March 2026 made it the first agentic browser genuinely usable across every device class. Claude for Chrome takes the opposite architectural bet: rather than replacing your browser, it instruments the one you already use, which lowers switching cost at the price of fighting Chrome's extension sandbox for capability. BrowserOS, the open-source entrant, matters less for its current polish than for what it guarantees: whatever the proprietary browsers learn about agentic UX will be reproduced in the open within months, the same diffusion dynamic playing out in models - GitHub. Nobody in this list has solved the category's core tension, which is that the more useful the agent, the more dangerous its mistakes inside an authenticated browser.

From first principles, the browser is the natural delivery vehicle for web-scoped agency: it already has your sessions, your cookies, your password manager, and your tabs, so an agent living there skips the hardest part of browser automation, which is authenticated context. That is why the category went from zero to five serious entrants in nine months. The tradeoff is equally structural: an agent with your authenticated sessions is an agent whose mistakes and injected instructions execute with your identity, which is why section 12 treats prompt injection in agentic browsers as the security story of 2026. For teams doing scaled or sensitive web automation, dedicated managed browser infrastructure with isolation still beats consumer agentic browsers; we compared that tooling layer in our stealth and managed browser guide.

How to apply this: treat agentic browsers as personal productivity endpoints, not automation infrastructure. They excel at supervised, interactive tasks (research, form filling, comparison shopping) where you watch the agent work. The moment tasks become unattended, repeated, or business-critical, you want server-side sessions, audit logs, and permission boundaries, which is the layer cloud platforms and browser-infrastructure vendors own.

9. China's Computer-Use Surge: Seed 2.1 and UI-TARS-2

The original article's landscape section was entirely Western: OpenAI, Anthropic, Google, Microsoft, and a handful of startups. The July 2026 leaderboards make that framing untenable. ByteDance released Seed 2.1 Pro and Seed 2.1 Turbo on June 24, 2026 at the Volcano Engine FORCE conference, and Seed 2.1 Pro now leads the llm-stats OSWorld tracker at 0.788, alongside leads on MobileWorld and MMMU-Pro - ByteDance Seed. The headline that matters for buyers is economic: ByteDance positions Seed 2.1 Pro at roughly 80% lower total cost of ownership than the Claude Opus 4.6 class, per the tracker data at llm-stats.com. Even discounting vendor framing, a frontier-class GUI model at a fraction of Western pricing changes procurement math for any organization able to use it.

The open-source side is arguably more consequential. UI-TARS-2, ByteDance's multi-turn reinforcement-learning GUI agent, publishes weights and a training methodology built on RL over real GUI interaction rather than supervised imitation, and posts 47.5% on OSWorld, 50.6% on WindowsAgentArena, 73.3% on AndroidWorld, and 88.2 on Online-Mind2Web - arXiv. Those numbers trail the proprietary frontier on desktop control but beat the 2025-era proprietary systems across the board, and the Online-Mind2Web score exceeds what Anthropic's current flagship posts under comparable judging. An open-weights model that outperforms last year's closed frontier is the classic diffusion pattern this industry keeps repeating.

UI-TARS-2's training methodology is worth two sentences of technical attention because it explains the score profile. The system is trained with multi-turn reinforcement learning directly on GUI interaction trajectories, with the reward attached to task completion rather than to imitating human demonstrations, which is why it punches far above its weight on live-web tasks (where recovery behavior dominates) while trailing frontier models on OSWorld-style desktop breadth (where world knowledge about many applications dominates) - arXiv. That profile is a preview of the field's direction: as RL environments for computer use get richer, expect open models to keep closing the gap on exactly the benchmarks that reward doggedness over knowledge.

What do open-weight GUI agents mean for enterprise buyers in practice? Three things, each with a caveat. Data sovereignty: you can run UI-TARS-2 entirely inside your own network, which matters enormously for regulated workflows where shipping screenshots of internal applications to a third-party API is a non-starter; the caveat is you now own the serving stack, GPU bill, and upgrade treadmill. Cost control: self-hosted inference on reserved hardware can undercut per-token API pricing at sustained volume; the caveat is the crossover point sits at higher volume than most teams expect. Fine-tuning: open weights let you specialize the agent on your own applications, which no closed vendor currently offers for computer use; the caveat is that RL fine-tuning for GUI agents remains a research-grade skill set. For most Western enterprises the realistic 2026 posture is a hybrid: closed frontier models for the hardest long-horizon work, open or cheap models for the high-volume repetitive middle.

The geopolitical wrinkle is worth one honest paragraph. Model provenance now appears in procurement reviews, and some organizations will not deploy ByteDance-origin models regardless of scores, while others (particularly outside the US) see the pricing and openness as decisive. Both positions are rational under different constraints. What is not rational in July 2026 is the 2025 default of simply not knowing these models exist: they are on the leaderboards, they are in production in large Chinese enterprises, and they set the floor for what "cheap and good enough" means globally.

10. What Died Since 2025: The Corrections Block

Refreshing a benchmark guide honestly means saying plainly which of its previous claims no longer hold. This section is that list. If you cited the 2025 version of this article, here is what to update, claim by claim.

Writer's Action Agent as the GAIA leader is over. The mid-2025 storyline had Palmyra X5 topping GAIA Level 3 at 61% and CUB at 10.4%. No July 2026 leaderboard features Writer, GAIA itself is effectively saturated with leaders above 92%, and Meta superseded it with GAIA2's 800 dynamic scenarios - Hugging Face. CUB has disappeared from the benchmark conversation entirely. Operator is dead as a product. OpenAI shut the standalone version on August 31, 2025 and folded Computer-Using Agent into ChatGPT agent mode; any pricing, access, or capability claim about standalone Operator is historical - presenc.ai. The OSWorld numbers are unrecognizable. Agent S2's 34.5% state of the art became Claude Mythos Preview's 85.4% on OSWorld-Verified, above the human baseline, with the frontier now measured on OSWorld 2.0 where the best score is 20.6%.

The vendor descriptions aged just as badly. Anthropic's "100K context, no consumer agent product" became Cowork, Computer Use previews, Claude for Chrome, and 83-85% OSWorld-Verified scores. Google's "Mariner or Astra, not fully released" became a shipping Gemini 2.5 Computer Use API model powering Mariner and Search's agentic mode - Google. Microsoft's story moved from Fara-7B and $30/seat Copilot framing to the Fara-1.5 paper (June 2026) and a market conversation centered on full desktop agents rather than chat sidebars. Manus's $39/$199 tiers became $20/$40/$200 with a free tier. And Salesforce's "Agentforce 2.0, launched 2025" positioning is at least one product generation stale in a market that now benchmarks agents on OSWorld 2.0 rather than demo videos.

Why publish a corrections block at all? Because the failure mode it guards against is the industry's default: articles that quietly swap numbers while keeping their 2025 conclusions, leaving readers with a frankenstein of fresh data and stale reasoning. The conclusions changed too. In 2025, the reasonable takeaway was "agents are promising but complete a third of desktop tasks; wait or pilot narrowly." In July 2026, the defensible takeaway is "agents exceed human baselines on short-horizon computer work and complete a meaningful fifth of two-hour professional workflows; deploy on the former, pilot aggressively on the latter." A reader acting on the 2025 conclusion today would simply be wrong, and no amount of updated leaderboard numbers fixes that unless the advice updates with them.

11. Models vs Harnesses vs Infrastructure: The Three-Layer Stack

A distinction the 2025 article never made, and one that now determines who wins each leaderboard, is that "an AI agent" is actually three separable layers. The model layer provides perception and decision-making: Claude Opus 4.8, GPT-5.5, Gemini 3.5 Flash, Seed 2.1 Pro. The harness layer wraps a model in scaffolding (planning loops, memory, retry logic, DOM access strategies): Browser Use, Agent S, GTA1, CoACT, and every vendor's proprietary agent mode. The infrastructure layer provides the environments agents run in: managed browsers, VMs, session persistence, and proxies from vendors like Steel and Browserbase. Firecrawl's mid-2026 field guide was among the first to rank the harness and infrastructure ecosystem as its own layer separate from the models - Firecrawl, and the leaderboards prove the layers matter independently: Browser Use Cloud's 97.0% on Online-Mind2Web is a harness achievement built on top of foundation models that score in the mid-80s when run raw.

The layering explains several things that look like paradoxes in flat leaderboard reading. It explains why a harness on a mid-tier model can beat a frontier model run naively: Online-Mind2Web rewards recovery strategies and DOM heuristics as much as raw intelligence. It explains why vendor benchmark revisions (section 4) are so slippery: when Anthropic "changes how it runs OSWorld-Verified," it is changing its harness, not its model, and harness improvements are real improvements even though they muddy model comparisons. And it explains where the margin lives commercially: models are being commoditized from above (frontier price cuts) and below (open weights), harnesses differentiate on reliability, and infrastructure earns steady per-session revenue regardless of which model wins the quarter.

For buyers, the layer framing converts into one practical question: which layers do you want to own? Assembling your own stack (open harness, API model, managed browser infrastructure) maximizes control and minimizes per-task cost at the price of engineering ownership. Buying a vertical product (Cowork, agent mode, Manus) minimizes setup at the price of flexibility. Platforms such as O-mega occupy the integrated-but-multi-model position: the harness and infrastructure are managed, while the model layer stays swappable as leaderboards move, which is a structural hedge against exactly the churn documented throughout this guide.

12. Security and the Agentic Traffic Explosion

Every capability gain documented above has a mirror-image risk story, and July 2026 is the first moment where that story has hard data instead of hypotheticals. Start with scale: HUMAN Security's April 2026 report found agentic browsers alone now generate close to 75% of all agentic traffic on the web - HUMAN Security. Agents are no longer a rounding error in traffic logs; they are the automated web. That changes the defender's problem from "detect bots" to "distinguish authorized agents acting for my users from everything else," which is a fundamentally harder classification task because the authorized agents use real browsers, real sessions, and real user credentials.

The sharpest technical risk remains prompt injection, and computer-use agents widen the aperture dramatically. A text chatbot can be injected through the conversation; a computer-use agent can be injected through anything it can see: a web page's hidden text, a PDF, an email, a calendar invite, a filename. Because agents in browsers and on desktops act with the user's authenticated identity (section 8), a successful injection does not need to exfiltrate credentials; it can simply act. The vendor mitigations are real but partial: Anthropic gates full Computer Use behind a research preview with approval prompts, ChatGPT agent mode interrupts before consequential actions, and Fable 5 ships with safety classifiers that fall back to Opus 4.8 when triggered - Anthropic. None of these makes injection impossible; they make it interruptible, which only helps when a human is watching.

Website owners are living the other side of this shift, and their responses will shape what agents can do next. When three quarters of agentic traffic comes through real browsers with real user sessions, the traditional bot playbook (block datacenter IPs, fingerprint headless browsers, throw CAPTCHAs) misfires against traffic that is, in a legal and often contractual sense, the user. Publishers and commerce sites are now splitting into postures: some are hardening against agents to protect ad impressions and scraping boundaries, others are publishing agent-friendly interfaces because an agent that can complete checkout is revenue. The unresolved question, being fought in robots.txt conventions, user-agent standards, and at least a few courtrooms, is whether "my agent, acting for me, with my account" inherits my access rights. However that settles, benchmark scores on live-web tests like Online-Mind2Web partially measure this social layer too: an agent's real-world success rate is capped by how much of the web decides to let agents transact at all.

For teams deploying agents on real work, the mitigations that matter are architectural rather than model-level. Run unattended agents in dedicated sessions with scoped credentials, never a human's primary identity. Keep an allowlist boundary around what domains and applications an agent can touch per task. Log every action durably enough to reconstruct what happened, because "the agent did something weird Tuesday" is now a real incident class. And treat long-horizon autonomy budgets (the 500-step runs from OSWorld 2.0) as a production risk dial, not just a benchmark parameter: more steps means more exposure surface per task. These are the boundaries agent workforce platforms enforce structurally, and they are the difference between an agent program that survives its first security review and one that gets frozen after it.

The model vendors' tiering strategies are themselves security artifacts, and reading them that way clarifies some otherwise puzzling product decisions. Anthropic splitting one underlying model into a generally available Fable 5 (with always-on classifiers and automatic fallback to Opus 4.8) and a restricted Mythos 5 (vetted partners only, under programs like Project Glasswing for cybersecurity work) is an explicit admission that peak capability and open availability no longer ship together - Anthropic. The same logic explains why full desktop Computer Use remains a research preview months after launch, and why every vendor's agent mode inserts approval friction that benchmark harnesses do not model. One consequence for readers of leaderboards: the gap between a lab's best benchmark number and what its shipped product will do on your machine is partly a safety tax, deliberately paid, and comparing a gated model's score to an open product's behavior overstates what you can actually buy.

The honest outlook is that security is currently the binding constraint on autonomy, more than capability is. The models can complete a fifth of two-hour workflows; almost no enterprise lets them run two hours unattended. Closing that gap is less about smarter models than about the boring infrastructure of identity, isolation, and audit, which is why the infrastructure layer from section 11 is where much of the serious engineering investment is flowing in the second half of 2026.

13. What to Watch Next and How to Choose

The near-term calendar is unusually concrete. GPT-5.6 Sol, Terra, and Luna launch publicly on July 9, 2026, the day after this refresh, at preview prices of $5/$30, $2.50/$15, and $1/$6 per million tokens - coursiv.io. If the family's computer-use numbers land anywhere near its pricing, the token-economics table in section 5 gets rewritten within the month, and the cheap-tier Luna pricing would put frontier-adjacent agency below every price point discussed in this guide. Gemini 3.5 Pro is officially "coming soon" above the 78.4%-scoring Flash - DeepMind. On Anthropic's side, the question is access rather than existence: Claude Mythos 5 already tops SWE-bench Verified at 95.5% and its preview sibling tops OSWorld-Verified, but it remains restricted to vetted partners, so watch for the widening of that access tier. And expect OSWorld 2.0's top score to move quickly; a 20.6% frontier with this much lab attention rarely stays put for two quarters.

Beyond the model calendar, three slower-moving developments will matter more by year end than any single launch. OSWorld 2.0 results will start appearing in marketing, and the first vendor to clear 30% will make noise; remember from section 4 that the number will only mean something with its step budget, token budget, and harness disclosure attached. GAIA2-style dynamic evaluation will spread into enterprise procurement, because static task lists systematically overstate reliability for ambient, interruption-heavy work, and buyers are noticing. And the judge-methodology fight on live-web benchmarks will get resolved or get worse: either the community standardizes on auditable judging for Online-Mind2Web-class tests, or self-judged 99% claims proliferate until the benchmark loses its authority the way unaudited GAIA claims did in 2025. Which way that goes determines whether the next edition of this guide can still cite a single live-web number with a straight face.

The durable way to choose, extracted from everything above, is a three-question framework. First, what horizon is your work? Short-horizon, repetitive web and desktop tasks are a solved procurement problem: pick on price and integration, because everything frontier-class clears the bar. Long-horizon professional workflows are frontier territory: only the Opus-class completion rates matter, the token bill is justified against human hourly cost, and you should pilot with explicit step budgets. Second, which layers do you want to own? Buy a vertical product for personal and small-team productivity; assemble or adopt a platform when agents become roles rather than sessions. Third, what does your security posture permit? Attended agency is deployable everywhere today; unattended agency is an infrastructure project, and vendors who hand-wave the identity and audit questions are selling you your next incident.

To make the framework concrete, walk three representative buyers through it. A solo professional automating research, drafting, and admin should buy a vertical product today: Claude Cowork or ChatGPT agent mode at $20 per month clears the short-horizon bar, the attended-use security model matches how they will actually work, and no math in section 5 justifies API plumbing at one-user scale. A five-person operations team with recurring web workflows sits at the layer-ownership decision: a harness like Browser Use on managed browser infrastructure, or an agent workforce platform if the workflows need scheduling, delegation, and durable identities rather than ad-hoc runs. A regulated enterprise should start from the security question and work backward: scoped credentials and audit infrastructure first, an attended pilot on OSWorld-2.0-class workflows second, and model selection last, because by the time governance is ready, the leaderboard will have changed anyway and the routed multi-model posture will absorb whatever it says.

Benchmark literacy is the meta-skill underneath all three questions. The numbers in this guide will age; the reading habits should not. Check the date on every score. Check whether it is OSWorld or OSWorld-Verified or OSWorld 2.0. Check the judge on every live-web claim. Check the step and token budget on every long-horizon result. And check whether a vendor's comparison chart mixes its own revised harness numbers with competitors' older ones, because after Anthropic's own retroactive revision of Opus 4.7's score, that failure mode is documented at the top of the market, not the bottom.

This guide is maintained by the team at O-mega, where AI agent workforces run browser and computer sessions against exactly these tradeoffs daily. It was written by Yuma Heymans (@yumahey), O-mega's founder, who spends an unreasonable fraction of his week rerunning these benchmarks' claims against live agent sessions before letting any of them steer the platform's model routing.

This guide reflects the computer-use benchmark landscape as of July 8, 2026. Scores, prices, and product availability in this field change monthly (GPT-5.6 launches the day after this update). Verify current numbers against the linked primary sources before making purchasing decisions.