Top 10 AI Desktop Automation Agents in 2026 (Mac & Windows)

The honest, fully refreshed guide to AI agents that actually operate your Mac or Windows machine in July 2026

Three of the products that dominated this ranking a year ago no longer exist. OpenAI's Operator was shut down on August 31, 2025. Google's Project Mariner was discontinued on May 4, 2026. And the Meta acquisition of Manus AI, which looked like the defining consolidation of the agent market, was blocked by Chinese regulators and fully unwound by June 15, 2026. If you are reading any "top AI agents" list that still ranks Operator first, you are reading fiction.

This is a ground-up refresh of our desktop automation ranking, rewritten in July 2026 with every product, price, and benchmark re-verified against primary sources this month. The field has changed more in eighteen months than most software categories change in a decade. When we first published this guide, the best computer-use agents completed roughly 25-40% of long workflows and analysts speculated they might reach human-level reliability "in a couple of years." That already happened. The OSWorld-Verified leaderboard now tops out around 85%, comfortably above the ~72% human baseline, with frontier models from Anthropic clustered at the top - Steel OSWorld Leaderboard. Agents also stopped being research previews: they now ship inside a $20/month ChatGPT Plus subscription, inside Chrome, inside Windows 11 itself, and as standalone desktop apps you install today.

This guide covers what each of the top 10 agents actually does, what it costs as of this month, where it runs (Mac, Windows, browser, cloud, or fully local), what the verified benchmarks say, and which kind of user each one fits. We also cover the categories that did not exist when this article was first written: agentic browsers, OS-level agent sandboxing, on-device agents, and the geopolitics that unwound a $2 billion acquisition. Everything here reflects the state of the market in July 2026.

This guide was researched and written by Yuma Heymans (@yumahey), founder of O-mega, who has spent the past two years shipping autonomous browser and computer-use agents into production and debugging the exact failure modes this guide describes.

Contents

1. What died since we first ranked this (the honest changelog)
2. Benchmark reality check: OSWorld in July 2026
3. Claude Cowork (Anthropic) - the autonomous desktop agent for knowledge work
4. ChatGPT Agent Mode & Atlas (OpenAI) - Operator's successor, now in Plus
5. Google's Gemini agent stack - Computer Use model, Chrome auto browse, Spark
6. Manus AI - independent again, with local desktop execution
7. O-mega - an autonomous AI workforce, not a single agent
8. Amazon Nova Act - metered agent fleets at $4.75 per agent-hour
9. Microsoft Copilot Actions, Agent Workspace & Fara-7B
10. Simular Agent S3 - the open-source frontier
11. Skyvern - vision-driven web automation on credits
12. Context - the enterprise agent platform with evals
13. The agentic browser takeover (Atlas vs Comet vs Chrome vs Claude)
14. Verified pricing across the board (July 2026)
15. OS-level security and sandboxing
16. Local and on-device agents
17. Enterprise fleet automation
18. The geopolitics of AI agents: the Meta-Manus unwinding
19. Which agent for which person: a decision framework
20. Key challenges and limitations
21. Future outlook
22. Conclusion

The July 2026 Ranking at a Glance

Before the detailed profiles, here is the full weighted assessment. We score each agent on five criteria: Capability (30%): verified task-completion performance and model quality; Platform reach (20%): where it actually runs (Mac, Windows, Linux, web, mobile, local); Ease of adoption (20%): how fast a non-engineer gets value; Price value (15%): what you pay relative to what you get, with transparent published pricing scoring higher; Enterprise readiness (15%): governance, auditability, deployment options, and fleet management. Scores run 0-10 and every cell states the reason for the number, not just the number.

Two notes on reading this table. First, the top three are separated by capability and packaging, not by category: all three now ship agentic capability to consumers at mainstream prices, which was true of exactly zero products when this article first ran. Second, the bottom half is not "worse software": Nova Act, Skyvern, and Context are deliberately narrower tools that win in their niches (fleet metering, web workflows, governed enterprise automation) while scoring lower on general desktop breadth. The decision framework in section 19 maps each to its right buyer.

1. What Died Since We First Ranked This

Most "best AI agents" articles quietly rewrite their history. We think the deaths are the most useful information in this guide, because they tell you how fast this market rotates and which vendors actually survived contact with reality. When this article was first published, the top two slots belonged to OpenAI Operator and Google Project Mariner, and Manus was described as "now part of Meta." Every one of those statements is now false.

OpenAI Operator is gone. Operator launched in January 2025 as a research preview gated behind the $200/month ChatGPT Pro tier, scored 38.1% on OSWorld and 58.1% on WebArena, and was deprecated and shut down on August 31, 2025 - Wikipedia. Its capabilities were folded into ChatGPT agent, launched July 17, 2025, which unified Operator's remote-browser control with deep research into a single agentic system available on Plus, Pro, Business, Enterprise, and Edu plans - OpenAI. The practical consequence is enormous: what used to cost $200/month in a locked preview is now a toggle inside the $20/month Plus plan. We tracked that pricing collapse in detail in our Operator pricing breakdown, and the original access mechanics are preserved in our early Operator access guide if you want a snapshot of how gated this technology was barely a year ago.

Google Project Mariner is gone too. Mariner launched December 11, 2024 as a DeepMind research prototype, went to Google AI Ultra subscribers on May 20, 2025, and was discontinued on May 4, 2026 - Wikipedia. The famous "Teach and Repeat" demos and the promise of broad availability "by summer 2025" are two full product generations stale. Mariner's DNA survived in three successors: the Gemini 2.5 Computer Use model shipped via API in October 2025, Chrome auto browse powered by Gemini 3 is rolling out in US preview, and the Gemini Spark background agent runs for Ultra subscribers. We covered Mariner's original launch in our Mariner announcement analysis, which now reads like a time capsule.

The Meta-Manus deal was blocked and unwound. Meta closed a roughly $2 billion acquisition of Manus AI in December 2025. China's regulator blocked it on April 27, 2026, and Meta completed an operational split and formally cut ties on June 15, 2026 - Codersera. Manus is independent again, shipped a desktop app with local execution in March 2026, and crossed $100M annualized revenue. Section 18 unpacks why this matters far beyond one company.

The pattern behind all three deaths is the same structural force: standalone agent products get absorbed into platforms. Operator became a ChatGPT feature. Mariner became a Chrome feature and an API. Manus survived precisely because it refused to become a Meta feature. When you evaluate any agent on this list, the first question is no longer "does it work?" but "will this still exist as a product in twelve months, and if not, which platform inherits it?"

2. Benchmark Reality Check: OSWorld in July 2026

The single most outdated claim in the previous version of this guide was the capability ceiling. We wrote that top systems completed "roughly 25-40% of the steps in 50-step workflows" and might reach human-level reliability "in the next couple of years." That prediction did not age; it detonated. The couple of years took about twelve months.

OSWorld remains the reference benchmark for computer-use agents: 369 real-world tasks across Ubuntu, Windows, and macOS environments, evaluated by actually executing the task and checking the resulting system state rather than grading text output - OSWorld. Humans complete a bit over 72% of these tasks. When Operator was state of the art it scored 38.1%. As of mid-2026, the verified leaderboard tracked by Steel shows Claude Mythos Preview at 85.4%, Claude Mythos 5 and Claude Fable 5 at 85.0%, Claude Opus 4.8 at 83.4%, Claude Sonnet 5 at 81.2%, and GPT-5.4 at 75.0%, with the best open-source entry, Qwen3 VL 235B, at 66.7% - Steel OSWorld Leaderboard. Anthropic's own reporting puts Opus 4.8 at 86.9% on OSWorld-Verified - Anthropic. The human baseline is not the ceiling anymore. It is a line in the rearview mirror for the top five models.

The trajectory matters as much as the snapshot, because it tells you how to discount every claim in this guide over time. Simular's Agent S line is the cleanest longitudinal record we have: Agent S opened at 20.6%, Agent S2 reached 48.8%, and Agent S3 hit 62.6% in a single run and 69.9% with Behavior Best-of-N in October 2025 - Simular. Plot that against Operator's 38.1% in early 2025 and the Claude cluster at 83-85% now, and you get a capability curve that has roughly doubled every year on the hardest execution benchmark that exists.

Three caveats keep this honest. First, self-reported and independently verified numbers coexist: Anthropic's 86.9% for Opus 4.8 is the vendor's figure, while Steel's tracker shows 83.4% for the same model under its harness, and both are legitimately "the benchmark." Treat any single number as a range of a few points. Second, WebVoyager is effectively retired as the field's headline metric. Skyvern's famous 85.8% and Fara-7B's 73.5% were earned on a benchmark of mostly static, well-known websites; the community moved to Online-Mind2Web and OSWorld-Verified because they resist memorization, and scores there are far lower (Opus 4.8 reports 84% on Online-Mind2Web, Fara-7B just 34.1%). When a vendor quotes WebVoyager in 2026, that itself is a signal. Third, benchmark tasks are bounded and legible, while your actual work involves ambiguous goals, credentials, and judgment calls. Crossing the human baseline on OSWorld means the models can execute; it does not yet mean they know what is worth executing. For a deeper comparison across the current frontier models, see our Claude Fable 5 and Mythos 5 benchmark breakdown and the wider model benchmarks and pricing roundup.

3. Claude Cowork (Anthropic): The Autonomous Desktop Agent for Knowledge Work

The previous version of this guide said something that is almost funny in hindsight: "you can't download a Claude agent app today." Anthropic held the strongest computer-use models and shipped no consumer agent product, and we scored them down for it. That gap closed completely. Claude Cowork launched as a desktop app in January 2026, reached Windows on February 10, 2026, and expanded to web and mobile on July 8, 2026, with cloud-run scheduled tasks that keep working after you close the laptop - TechCrunch. It is now the closest thing this market has to a default answer for "give me an AI that does real work on my computer."

What makes Cowork different from a chat assistant is the execution model. You point it at folders, connect the tools you already use, and delegate outcomes rather than prompts: clean up this contract redline, reconcile these two spreadsheets, draft the board update from these notes, monitor this inbox and triage. The agent plans, opens and edits files, browses when it needs information, and reports back with its work product. Under the hood it runs on Anthropic's current model lineup, which as of the live model docs means Claude Opus 4.8 ($5/$25 per million tokens, 1M context), Claude Fable 5 (GA June 9, 2026), Claude Sonnet 5, and Claude Haiku 4.5, with the invitation-only Claude Mythos 5 at the research frontier - Anthropic model docs. The stale "Claude has a 100K context window" claim from the original article is off by an order of magnitude: current models carry 1M-token context windows, which is what lets Cowork hold an entire project's files in working memory.

The adoption data is the strongest evidence that this is a real category and not a demo. Anthropic's analysis of 1.2 million Cowork sessions across more than 600,000 organizations (May 2026) found 33.4% business process work, 16.4% content creation, and only 8.7% software development - TechCrunch. Read that split carefully: the coding-agent wars produced a product whose dominant use is not coding. Ops people, finance people, and marketers quietly became the majority users of the most capable desktop agent on the market.

Pricing and availability - Claude Cowork:

Cowork runs on macOS, Windows, Linux, ChromeOS, web, and mobile beta, which is the broadest platform footprint of anything in this ranking. The companion piece is Claude for Chrome, a browser extension in beta on all paid plans that navigates, clicks, and fills forms inside your logged-in browser and hands work back and forth with Cowork and Claude Code - Claude for Chrome.

The honest limitations: Cowork is a single-user, single-agent experience at heart. It executes your delegation brilliantly, but it does not natively model a team of specialized agents with separate roles, credentials, and schedules, and heavy users on Pro will hit usage limits and feel pulled toward the $100-200 Max tiers. For a much deeper operational walkthrough, see our Claude Cowork autonomous desktop guide and the Cowork pricing and ecosystem breakdown.

Best for: knowledge workers on any OS who want the most capable general desktop agent available today, backed by the models that lead OSWorld-Verified. If you only try one product from this list, try this one.

4. ChatGPT Agent Mode & Atlas (OpenAI): Operator's Successor, Now in Everyone's Plan

OpenAI's agent story in 2026 is a tale of consolidation. Operator is dead, and everything it did now lives in two places: ChatGPT Agent Mode, available inside the standard ChatGPT apps, and ChatGPT Atlas, OpenAI's agentic browser. Agent Mode descends directly from the July 2025 launch of ChatGPT agent, which unified Operator's remote-browser control and deep research into one system that thinks, browses, runs code in a virtual computer, and produces files - OpenAI. It handles the classic desktop-automation demo set (fill this form across three portals, compare these vendors and build a spreadsheet, book the least-bad flight) with confirmation prompts before consequential actions.

The pricing collapse is the headline. Operator required the ~$200/month tier; Agent Mode is included in Plus at $20/month. The full July 2026 lineup: Free at $0 (GPT-5.3 Instant, ad-supported in the US), Go at $8/mo, Plus at $20/mo with the GPT-5.5 flagship, Agent Mode, and 10 Deep Research runs monthly, and a restructured Pro lineup split in April 2026 into $100/mo (5x limits) and $200/mo (20x limits, ~1M token context) - CloudZero. The original article named a flagship model that is now two full generations stale: the current model is GPT-5.5, priced at $5/$30 per million input/output tokens on the API. Our GPT-5.5 benchmarks and real-work guide covers what the flagship actually delivers outside marketing copy.

ChatGPT Atlas is the more radical product. Launched October 21, 2025 on macOS, Atlas is a full browser with Agent Mode built into the tab itself: the agent browses your actual logged-in sessions rather than a remote sandbox, with an isolated clipboard, a logged-out agent mode for sensitive sites, and memory of your browsing context. The catch for half this guide's audience: Atlas is still Mac-only as of mid-2026, with no shipped Windows build - DataStudios. Windows users get Agent Mode through the regular ChatGPT app and the web, which covers most use cases but lacks the native local-browser integration.

Where OpenAI trails: on the hardest verified desktop benchmark, GPT-5.4 scores 75.0% on OSWorld versus the Claude cluster at 83-85%, and OpenAI's agent surface is fragmented across ChatGPT, Atlas, and the API in a way that Anthropic's Cowork-centered lineup is not. Where OpenAI wins: distribution. Hundreds of millions of people already have ChatGPT, and for them Agent Mode is not a new product to adopt but a toggle to flip. That, plus the lowest capable entry price in the market, keeps it at #2.

Best for: anyone already paying for ChatGPT Plus who wants strong agentic browsing and research without adopting a new tool, and Mac users who want the deepest agent-in-browser experience via Atlas.

5. Google's Gemini Agent Stack: Computer Use, Chrome Auto Browse, and Spark

Google's entry is no longer one product but a stack, and you need the map because the old product names are dead. Project Mariner was discontinued on May 4, 2026 - Wikipedia. What replaced it operates at three layers. At the model layer, the Gemini 2.5 Computer Use model shipped October 7, 2025 in public preview through the Gemini API on AI Studio and Vertex AI, hitting over 70% accuracy on browser control benchmarks at roughly 225 seconds of task latency, and it powered Mariner, the Firebase Testing Agent, and agentic features in AI Mode in Search before Mariner was retired - Google DeepMind. At the consumer layer, Chrome auto browse, powered by Gemini 3, handles multi-step chores like filling forms, collecting quotes, scheduling appointments, and gathering tax documents, rolling out in US preview for Google AI Pro and Ultra subscribers with mandatory confirmation gates before purchases and social posts - Google. At the background layer, the Gemini Spark agent runs longer autonomous jobs for Ultra subscribers.

The strategic logic is pure Google: do not ship an agent app, make the world's most-used browser agentic. Chrome auto browse requires no new download, no new habit, and no new subscription for existing AI Pro users. That is a distribution advantage no startup can match, and it is why we rank the stack #3 despite the preview gating.

Google AI pricing (April-May 2026) - 9to5Google:

Note that Ultra's entry price was cut from $249.99, part of the across-the-board price compression this market saw in early 2026.

The limitations are real. Auto browse is US-only preview as of July 2026, Chrome-centric by design, and Google's agent surface has the company's trademark churn risk: Mariner is the second Google agent brand to die in eighteen months, and buyers remember. The Computer Use model is also browser-optimized rather than full-desktop: it does not yet control native OS applications at the level OSWorld demands, which is why Google does not appear near the top of that leaderboard. For most consumers none of this matters; for anyone building durable automation on Google's agent APIs, version and product stability is a genuine planning risk.

Best for: people who live in Chrome and Google Workspace and want ambient agentic help with zero new tools, and developers who want a fast browser-control model via Vertex AI.

6. Manus AI: Independent Again, With Local Desktop Execution

Manus has the strangest corporate biography in this guide and one of the strongest products. The original article said Manus was "now part of Meta." That was true for about four months. Meta closed the ~$2B acquisition in December 2025, China's regulator blocked it on April 27, 2026, and Meta completed the operational split on June 15, 2026 - Codersera. Through all of that, the product kept shipping: Manus crossed $100M annualized revenue in December 2025 and launched a desktop app in March 2026.

The desktop app is the part that earns Manus its slot in a desktop automation ranking. Historically Manus was a cloud agent: your task ran in a remote VM you could watch like a screen recording. The March 2026 release added "My Computer" local execution: the agent can run terminal commands and operate on local files on your actual machine, with a per-command permission gate so nothing executes without an explicit approval step. That hybrid (cloud VMs for scale, local execution for your real files) is a genuinely differentiated architecture; among general consumer agents only Cowork offers comparable local reach, and Manus adds the watch-it-work session replay that made it famous.

On capability, Manus 1.5 scores 86.5% / 70.1% / 57.7% on GAIA Levels 1-3, a strong showing on the general-assistant benchmark, and the product handles long multi-step tasks (research reports, site builds, data collection runs) with good persistence. Pricing as of July 2026: Free with 300 daily credits and one concurrent task, $20/mo for 4,000 monthly credits, a $200/mo Extended tier with 40,000 credits, and Team at $20/seat/mo - Codersera. The credit model is the main friction: heavy tasks burn credits at rates that are hard to predict in advance, and power users regularly discover their real monthly cost only after a few big jobs.

The unresolved question is trust. Manus relocated operations to Singapore, but the blocked acquisition put its Chinese origins in front of every enterprise procurement team on earth, and a per-command permission gate does not answer data-residency questionnaires. Individuals and startups love the product; regulated enterprises mostly still hold back, and section 18 explains why that hesitation now has regulatory case law behind it.

Best for: individual power users and small teams who want a general-purpose agent that can both run big cloud jobs and touch local files, and who value watching the agent work step by step.

7. O-mega: An Autonomous AI Workforce, Not a Single Agent

Full disclosure first: O-mega is our product, and it is in this list because it occupies a slot nothing else here fills, scored with the same rubric as everything else. Every other entry in this ranking is fundamentally one agent you supervise. O-mega's model is an AI workforce: multiple persistent agents with names, roles, credentials, and schedules, each able to run browser sessions and computer sessions in the cloud, coordinated by orchestration rather than by you personally babysitting each task.

The distinction matters at a specific scale. If you have one recurring task, a single agent (Cowork, Agent Mode, Manus) is the right shape. If you are trying to offload a function (all of outbound research, all of listing management, all of weekly reporting) you end up wanting separate agents with separate logins, separate memories of how their process works, and a delegation chain between them, which is exactly what the workforce model provides. Agents share a company-level memory, discover and execute skills, and hand tasks to each other, so the unit you manage is the process, not the prompt. Our guide to agentic business process automation covers this architectural argument against classic RPA in depth, and our capabilities catalog for AI agents shows the tool surface each agent can draw on.

Because agents run in cloud browser and VM sessions, O-mega is OS-agnostic: you direct it from a Mac, a Windows machine, or a phone, and the execution environment is the same. That also means it does not touch your local files the way Cowork or Manus's My Computer mode can, which is the honest trade-off: local-first privacy buyers should look at section 16 instead. Pricing is workforce-shaped rather than seat-shaped, which prices above single-agent consumer tools; for a one-task user that is the wrong deal, for a multi-process business it replaces headcount rather than a subscription. We keep a comparative list of Cowork-class agent alternatives updated if you want the head-to-head landscape.

Best for: founders and operators who want to delegate entire recurring business processes to a coordinated set of agents, rather than supervising one assistant task by task.

8. Amazon Nova Act: Metered Agent Fleets at $4.75 Per Agent-Hour

The original article described Nova Act as "a research preview with no published pricing." Both halves of that sentence expired. Nova Act reached general availability on December 2, 2025 as a full AWS service in US East (N. Virginia), with a web playground at nova.amazon.com/act, a Python SDK, an IDE extension, and native integration with Bedrock AgentCore Runtime - AWS documentation. And the pricing is now the most transparent in the entire category: $4.75 per agent-hour of real elapsed working time, with parallel agents billed separately and human-in-the-loop wait time explicitly excluded from the meter - AWS pricing.

That pricing model deserves a pause, because it reframes the whole market. Every other vendor here prices agents like software: seats, tiers, credits. AWS prices them like labor. An agent-hour is a unit you can put in a spreadsheet next to a contractor's hourly rate, and the comparison is brutal in the agent's favor for any workflow it can actually complete: a task that takes an agent 20 minutes costs about $1.58, and running ten agents in parallel for an hour costs $47.50, less than one hour of almost any human knowledge worker in the OECD. When we analyzed agent economics in our cost of AI agents report, the missing piece was exactly this kind of clean per-hour meter; Nova Act supplied it.

The design philosophy differs from the generalists too. Nova Act encourages small, atomic act() calls ("find the invoice number", "download the statement") composed inside ordinary Python, rather than one grand open-ended instruction. The bet is that repeatability beats generality for production automation: a fleet of narrow, testable steps that succeeds almost every time is worth more to a business than a brilliant generalist that succeeds 80% of the time on open-ended prompts. Wrapped in AWS IAM scoping, CloudWatch logging, and AgentCore orchestration, that makes Nova Act the most operationally governable browser automation in this list, and the least exciting to demo. The Nova model family behind it has been building since Amazon's original Nova launch.

The limits are the mirror image of the strengths. Nova Act is browser-scoped, not a full desktop agent; it will never touch your local file system. It is developer-facing: no consumer app, no chat interface, just SDK and playground. And metered pricing punishes slow, meandering tasks, so it rewards teams who engineer workflows tightly and penalizes exploratory use. Expect to encounter Nova Act as the invisible engine inside internal tools rather than as a product you open.

Best for: engineering and operations teams on AWS who need high-volume, repeatable browser automation with labor-style metering, IAM governance, and parallel fleets.

9. Microsoft Copilot Actions, Agent Workspace, and Fara-7B: The OS Fights Back

Microsoft's entry has transformed more than any other since the original ranking, which described a "Windows Copilot sidebar." That framing is obsolete. Windows 11 now ships experimental agentic features at the OS level: Copilot Actions performs multi-step chores on local files and apps, and it runs inside an Agent Workspace, a contained desktop session where the agent operates under its own dedicated low-privilege agent account, separate from your user account, with scoped access to known folders. The features are off by default, require builds 26100.7344 or later, and live under Settings > System > AI Components - Microsoft support. Default-on behavior starts rolling out with Windows 11 version 26H2 in the Insider Experimental channel from July 2026.

Judged purely as an agent today, Copilot Actions is mid-pack: the preview handles a bounded set of file and app tasks and lags the frontier generalists on open-ended work. Judged as infrastructure, it is the most consequential item in this guide, because it answers the question every IT department has been asking: who is accountable when an agent acts? Microsoft's answer is to give the agent an identity the OS understands, a workspace the OS can contain, and an audit trail the OS can produce. No third-party agent vendor can offer that, because none of them own the operating system. Section 15 goes deeper on this security model.

The second half of Microsoft's story is Fara-7B, and it corrects another stale claim. The original article called Fara a just-released research prototype that was "not plug-and-play." Fara-7B shipped November 24, 2025 under an MIT license, built on a Qwen2.5-VL-7B base and trained on 145,000 synthetic trajectories from the Magentic-One pipeline; it scores 73.5% on WebVoyager and 34.1% on Online-Mind2Web at roughly 16 steps per task, and it now runs quantized on Copilot+ PCs via the AI Toolkit - Microsoft Research. That makes it the first credible on-device computer-use model on consumer Windows hardware: your screen pixels never leave the machine. Microsoft kept building on the research side too, adding CUAVerifierBench (April 19, 2026), a human-annotated benchmark for judging agent trajectories, and a Universal Verifier for WebTailBench - GitHub.

The roadmap points one direction: agents as a native Windows primitive. The Ask Copilot taskbar experience and deeper Copilot integration are scheduled for mid-2026, aimed first at enterprise "Frontier Firms" - Windows Latest. The weaknesses are equally clear: nothing here helps Mac users at all, the current preview's capability ceiling is well below Cowork or Agent Mode, and Microsoft's naming churn (this is at least the fourth Copilot-branded automation surface) makes it genuinely hard for buyers to know what they own. We track Microsoft's broader agent lineup, including its Cowork-adjacent offering, in our Copilot Cowork analysis, and the lineage of screen-reading Copilot features in our Copilot Vision coverage.

Best for: Windows-first organizations that need OS-enforced agent identity and containment, and privacy-conscious users who want an on-device agent model on Copilot+ hardware.

10. Simular Agent S3: The Open-Source Frontier

Agent S3 is what the research frontier looks like when it is given away. Released open source by Simular on October 2, 2025, it is a compositional framework that wraps frontier models with planning, grounding, and its signature technique, Behavior Best-of-N (bBoN): run several complete attempts at a task, convert each trajectory into a compact behavior narrative, and have a judge select the best run. That wrapper alone lifted OSWorld performance from 62.6% single-run to 69.9% - Simular. The lineage tells the velocity story better than any single number: Agent S opened at 20.6%, Agent S2 (which the original article cited as state of the art at 34.5%, later reaching 48.8%) held the crown briefly, and S3 blew past the 72% human baseline discussion entirely within a year.

What makes S3 more than a leaderboard artifact is that it runs on real machines: macOS, Windows, and Linux, driving actual applications rather than a fixed demo sandbox. For a technical team it is the cheapest path to owning a near-frontier desktop agent outright: the framework is free, you pay only model API tokens, and you can swap the underlying model as the price-performance frontier moves, a frontier we track in our Claude Sonnet 5 cost breakdown. The bBoN idea also escaped the repo: best-of-N trajectory selection with a behavioral judge quietly showed up in several commercial stacks within months, which is the usual afterlife of good open agent research.

The costs are equally concrete. There is no safety layer beyond what you build: S3 will click anything it is authorized to click, so production use demands your own sandboxing, allowlists, and human gates. Multi-attempt bBoN runs multiply token spend by the number of attempts, so the 69.9% configuration costs several times the 62.6% one, and you should budget for that gap explicitly. And it is a Python framework with real setup, not a product; non-technical readers should file this entry under "what your engineers could build on," alongside the broader landscape in our open-source personal AI guide.

Best for: engineering teams that want a state-of-the-art, fully controllable, self-hosted desktop agent without per-seat licensing, and researchers extending the frontier.

11. Skyvern: Vision-Driven Web Workflows on Credits

Skyvern keeps its slot by doing one unglamorous thing extremely well: automating web forms and portals that were never meant to be automated. It is open source at its core, combines vision models with DOM parsing so workflows survive site redesigns, and is a workhorse for the grinding B2B tasks of insurance portals, government filings, procurement systems, and supplier onboarding. Its long-quoted 85.8% WebVoyager score is real but increasingly beside the point: WebVoyager is a largely retired benchmark of mostly static sites, and on the harder evaluations that now define the field (Online-Mind2Web, OSWorld-Verified) dedicated form-fillers are not the leaders. Skyvern's honest pitch in 2026 is reliability on its niche, not frontier generality.

The pricing changed materially since the original article, which quoted $0.05 per step. That model is gone, replaced by monthly credits - Skyvern.

Skyvern pricing (July 2026) - Skyvern pricing:

The free tier is genuinely usable for evaluation, and self-hosting the open-source core remains free forever, which for compliance-heavy buyers is the headline feature: the entire automation stack can run inside your network and be audited line by line. The trade-offs define the boundary. Skyvern is web-only, with no native desktop reach; it is a builder's tool with an API and workflow builder rather than a consumer app; and generalist agents have eroded the low end of its market, since a $20/month ChatGPT Plus plan now handles the one-off form tasks that once justified dedicated tooling. What generalists still cannot do is run 25 concurrent, monitored, retried workflows against hostile legacy portals every night. That is precisely the work Skyvern keeps, and it is the same industrial tier of web automation where infrastructure choices like stealth browser environments start to matter.

Best for: businesses with recurring, high-volume web-form workflows (insurance, filings, procurement) and teams that need a self-hostable, auditable web automation stack.

12. Context: The Enterprise Agent Platform With Evals

Context is the entry that changed identity rather than dying. The original article described a document-and-browser assistant; the company has since repositioned entirely as "the unified platform for enterprise AI": a Workspace for agent-driven work, an Engine with 800+ connectors into enterprise systems, a Unify knowledge graph, and, most importantly, an Evals product with rubrics and golden sets for measuring whether agents actually do their jobs - Context. Deployment options run from cloud to VPC, on-prem, and air-gapped, and the customer list is no longer hypothetical: Qualcomm, Stripe, Palantir, FPL, and Itaú are named accounts.

The Qualcomm case study is the number that should reframe how you think about enterprise agents: agent accuracy on their workflows went from 23% to 98%, across roughly 100 production workflows, through systematic evaluation and iteration rather than through waiting for a better model - Context. That is the same lesson Agent S3's bBoN teaches at the research level and CUAVerifierBench teaches at the benchmark level: in 2026, verification is the capability. Raw model intelligence is table stakes; the differentiating machinery is the loop that measures, catches, and corrects agent failures before they compound. This is also why "agentic AI" is displacing classic RPA in the enterprise, an argument we made from first principles in RIP RPA: making way for an agentic future.

Context's weaknesses for this guide's audience are structural rather than qualitative. There is no published pricing, only custom enterprise contracts, which costs it points in our rubric on principle: unpriced software cannot be comparison-shopped. It is a platform sale with onboarding, not a download, so individuals and small teams are simply not the market. And its "desktop automation" is really workflow automation across enterprise systems; it will not move your mouse. But if the question is "how does a 10,000-person company deploy agents without creating a thousand ungoverned robots," Context is one of the few answers with production receipts.

Best for: enterprises that need governed, evaluated, connector-rich agent automation across internal systems, with compliance-grade deployment options.

13. The Agentic Browser Takeover

The biggest structural blind spot in the original article was not any single product: it was a missing category. In January 2026 we treated "the browser" as one feature of desktop agents. By July 2026, agentic browsers are the dominant consumer surface for AI automation, because the browser is where consumer tasks actually live: logins, forms, purchases, comparisons, portals. If the agent lives inside the browser, it inherits your sessions, your context, and your trust boundary without any OS-level integration at all.

The field is crowded and moving fast. ChatGPT Atlas (macOS, October 21, 2025) leads on depth of agent integration but remains Mac-only. Perplexity Comet made the opposite bet: it has been a free download since October 2025 and fully free on all four platforms since April 2026 (macOS, Windows, Android, iOS), with paid plans adding a Background Assistant for multi-step tasks that run while you work - Firecrawl. Chrome auto browse brings Gemini 3 agency to the browser people already use. Claude for Chrome adds Anthropic's agent as an extension inside your existing Chrome. Opera Neon sells a $19.90/month power-user browser with 169+ model options, and Dia, the AI-native browser from the Browser Company, was acquired by Atlassian, signaling that even collaboration vendors want an agentic browser surface. On the open-source side, Browser Use reports an 89.1% WebVoyager success rate and has become the default library developers reach for.

For Mac and Windows buyers the availability matrix is the decision in miniature. Atlas is the deepest experience but excludes Windows entirely; Comet is the only full agentic browser that covers both desktops and both mobile platforms for free; Chrome auto browse and Claude for Chrome meet users inside the browser they already have, on both OSes, but gate on subscriptions (Google AI Pro/Ultra) or paid Claude plans respectively.

The strategic read from first principles: browsers are where distribution beats capability. A slightly weaker agent inside Chrome reaches billions of people; a stronger agent inside a new browser must win a browser-switching decision that users make roughly once a decade. That is why Google's and Anthropic's extension-style plays may matter more over time than any standalone agentic browser, and why OpenAI's Windows-shaped hole in Atlas is a real strategic cost, not a scheduling detail. It is also why Perplexity gives Comet away: in a distribution war, free is a weapon, funded by the search-disruption war chest it raised precisely for this fight.

14. Verified Pricing Across the Board (July 2026)

Pricing in this market rotted faster than any other fact in the original article, so this section exists as a single table you can screenshot, with every number checked against the vendor's official pricing page this month. Two structural trends explain most of the movement since early 2025: agent capability moved down-tier (what cost $200/month lives at $20 or less now), and metered models emerged (Nova Act's agent-hours, credit systems at Manus and Skyvern) for usage-shaped buying.

Sources for every row: OpenAI tiers per the July 2026 breakdown - CloudZero; Claude plans - Claude Cowork; Google tiers - 9to5Google; Comet's free-everywhere status - Firecrawl; Manus credits - Codersera; Nova Act metering - AWS; Skyvern credits - Skyvern.

Reading the table strategically: the $20/month price point is where the volume war is being fought, with OpenAI, Anthropic (at $17), Google (at $19.99), and Manus all converging there, and each of the majors keeping a $100 and $200 rung above it for heavy users, right where API economics start to favor power users switching to per-token billing. On the API side the same compression happened: GPT-5.5 costs $5/$30 per million tokens, Claude Opus 4.8 held at $5/$25 with a fast mode at $10/$50 that is 3x cheaper than its predecessor's fast mode - Anthropic. For a buyer, the practical rule is: start at $20, measure how often you hit limits, and only then decide between a $100 tier and metered/API pricing, because the break-even depends entirely on your task mix.

15. OS-Level Security and Sandboxing: Containing the Agent

Security went from a footnote to a product axis in one year, and the reason is structural: an agent that can operate your computer is, by definition, malware with permission. Everything that makes these tools useful (reading your files, clicking inside your logged-in sessions, running commands) is exactly what an attacker wants to do, so the interesting engineering question of 2026 is not "can the agent act" but "how is the agent contained when it acts on a lie." Every serious vendor now ships an explicit containment story, and comparing those stories is one of the most useful ways to compare the products.

The containment models cluster into four approaches. Microsoft builds containment into the OS: Agent Workspace gives agents their own low-privilege Windows accounts and contained desktop sessions, off by default until 26H2 - Microsoft support. OpenAI isolates at the application layer: Atlas runs agent actions with an isolated clipboard, a logged-out mode that keeps the agent away from your credentials entirely, and watch-mode requirements on sensitive sites. Google gates at the action layer: Chrome auto browse requires explicit confirmation before purchases and social posts - Google. Anthropic and Manus gate at the permission layer: Cowork works inside explicitly granted folders, Claude for Chrome ships sensitive-data warnings, and Manus's My Computer mode requires per-command approval for local execution.

The honest state of the art is that all four models mitigate and none of them solve prompt injection: a malicious page or document that instructs the agent to exfiltrate data or take hostile actions. Injection is to agents what phishing is to humans, except the victim reads at machine speed and never gets suspicious on its own. Confirmation gates help exactly where they are applied and nowhere else; low-privilege accounts bound the damage without preventing the attempt; logged-out modes shrink the attack surface at the cost of capability. Until models can reliably distinguish instructions from content (an unsolved research problem), the practical guidance is unromantic: grant minimal scopes, prefer agents that show their work, keep confirmation gates on for anything involving money or credentials, and treat "the agent did it" as an incident class your team will eventually file. For the on-device angle of this same argument, section 16 follows; for a deeper security treatment of agent infrastructure, our insider guide to building AI agents covers threat models for builders.

The buyer-level takeaway: match the containment model to your risk. If your worst case is a bad purchase, confirmation gates (Chrome, Atlas) are enough. If your worst case is a compromised workstation in a regulated environment, OS-level agent accounts (Windows 26H2) or fully local models are the only architectures that even speak your language.

16. Local and On-Device Agents: The Privacy-First Path

A distinct buyer path crystallized in 2026 that the original article barely gestured at: people and companies whose constraint is not capability but data locality. Legal teams with privileged documents, healthcare workflows, European enterprises with data-residency clauses, and individuals who simply refuse to stream their screen to a cloud vendor all need the agent to run where the data is. Eighteen months ago that meant "no agent for you." Now it is a real, if trade-off-laden, product category.

Three options anchor the path. Fara-7B is the flagship: MIT-licensed, small enough to run quantized on Copilot+ PCs, and specifically trained for computer use, so screenshots and actions never leave the device - Microsoft Research. Its 34.1% Online-Mind2Web score is far below the frontier, but for bounded, repeated workflows on sensitive data, "capable enough and provably local" beats "brilliant and cloud-bound." Qwen3 VL 235B is the open-weight ceiling: at 66.7% on OSWorld it is within ten points of the human baseline and can be self-hosted on serious hardware, giving enterprises a frontier-adjacent agent model with full custody - Steel. And Manus's My Computer mode represents the hybrid compromise: cloud intelligence, but local execution with a per-command permission gate, so the model reasons remotely while your files stay put unless you approve each touch.

The trade-offs deserve blunt statement, because privacy marketing tends to blur them. Local models are meaningfully less capable: the gap between Fara-7B's 34.1% and Opus 4.8's 84% on the same benchmark is not a rounding error, it is the difference between an agent you delegate to and an agent you operate. Self-hosting Qwen3-class models costs real infrastructure and MLOps attention. And hybrid architectures like Manus's still ship your instructions and reasoning traces to a cloud, which some threat models cannot accept. The right mental model is a dial, not a switch: put routine work on frontier cloud agents, and reserve the local stack for the specific workflows where data custody is the binding constraint. Our guides to open-source personal AI and open-source AI coders map the self-hosted tooling in depth.

Structurally, expect this gap to close from both ends: on-device silicon improves annually, and the 7B-class models of 2027 will likely match the cloud frontier of 2025, which was already good enough to be useful. Privacy-first automation is a lagging copy of the frontier, roughly eighteen months behind, and for many buyers that lag is an acceptable price for custody.

17. Enterprise Fleet Automation: Agents by the Hour

Everything above this section automates one person's work. The enterprise question is different in kind, not just scale: how do you run hundreds of agents in parallel, attribute their actions, measure their accuracy, and pay for them in a way procurement understands? Three entries from the ranking form the current answer, and they compete on governance rather than intelligence.

Nova Act is the metering play. At $4.75 per agent-hour with parallel agents billed separately, it turns automation into a line item that maps to labor budgets, and its Bedrock AgentCore integration handles fleet orchestration, retries, and IAM-scoped credentials - AWS. Skyvern is the throughput play: 25 concurrent workflows on the $149 Pro tier, self-hostable for compliance, purpose-built for the portal-and-form drudgery that dominates back-office automation - Skyvern. Context is the governance play: 800+ connectors, VPC and air-gapped deployment, and above all evals with rubrics and golden sets, the machinery behind Qualcomm taking agent accuracy from 23% to 98% across roughly 100 production workflows - Context.

The Qualcomm number is worth dwelling on because it inverts the usual buying logic. The difference between a failed enterprise agent program and a transformative one was not model choice: it was measurement infrastructure. A 23%-accurate agent is a liability generator; the same platform, iterated against golden sets and rubrics, became more reliable than most human-executed processes. From first principles this is exactly what you would predict: agents are stochastic systems, and stochastic systems become production systems only through the boring apparatus of test suites, monitoring, and regression control. Enterprises that treat agents as software to be QA'd succeed; enterprises that treat them as magic employees churn through pilots. This is the same conclusion our agentic business process automation analysis reached from the RPA side of history.

Where does a workforce platform like O-mega sit in this frame? Between the consumer single-agent tools and the heavy enterprise platforms: multiple persistent agents with roles, credentials, and schedules, without the six-month platform onboarding. For a 10-person company automating five recurring processes, that middle tier is usually the right size; for a 10,000-person company with compliance officers, the Context-shaped platforms earn their procurement cycle. The mistake to avoid at every size is the same one: buying agent capability without buying agent accountability.

18. The Geopolitics of AI Agents: The Meta-Manus Unwinding

The Manus saga earns its own section because it is the first time a major AI agent company was acquired, un-acquired, and re-independentized by regulatory force, and the precedent will shape the market for years. The timeline: Meta closed a roughly $2 billion acquisition of Manus in December 2025. On April 27, 2026, China's regulator blocked the deal, asserting jurisdiction through Manus's Chinese-origin technology and team, even though the company had relocated operations to Singapore. Meta completed an operational split and formally cut ties on June 15, 2026 - Codersera. Manus walked away independent, funded, and with a desktop app it shipped mid-drama.

The first-order lesson is about jurisdiction following origins. Relocation to Singapore did not launder Manus's regulatory exposure: the technology's provenance kept Beijing's leverage intact. Every Chinese-origin AI startup now knows its exit options to Western acquirers are constrained no matter where it domiciles, and every Western acquirer knows a Chinese-origin AI deal carries an unpriceable regulatory veto. Expect three durable effects: earlier and more aggressive relocation by founders (before the technology matters enough to attract jurisdiction), acquisition structures that license rather than transfer core technology, and a valuation discount on Chinese-origin AI assets that has nothing to do with their quality.

The second-order lesson is about what states now consider strategic. Regulators did not block a chip deal or a weapons deal; they blocked the sale of a company whose product operates computers on behalf of users. That is a statement that agentic AI, the ability to act, not just to know, is now sovereignty-relevant infrastructure in the eyes of at least one major power. Combined with Windows building agent identity into the OS (section 9) and enterprises demanding air-gapped agent deployment (section 17), the direction is coherent: agents are being treated as actors, and actors get regulated, contained, and fought over in ways passive software never was.

For buyers the practical consequence is a new diligence question that did not exist in 2024: not just "is this product good" but "what flag does this product fly, and what happens to my automation if that flag becomes a problem." Manus the product remains excellent, and its $100M annualized revenue says users have priced the risk and bought anyway. Enterprise procurement teams, so far, mostly have not. Both positions are rational; what is no longer rational is pretending the question does not exist.

19. Which Agent for Which Person: A Decision Framework

Rankings compress too much, so here is the decision logic laid out the way we actually advise people, as a sequence of forks. The first fork is where your work lives: if the tasks are entirely web-shaped (forms, portals, research, purchases), an agentic browser or browser agent is the right species, and you never need to grant local-file access at all. If the work involves your actual files and applications, you need a desktop agent (Cowork, Manus) or an OS-integrated one (Copilot Actions). The second fork is who operates it: products for non-technical users (Cowork, Agent Mode, Comet, auto browse) versus builder tools (Agent S3, Nova Act, Skyvern, Browser Use). The third fork is where it may run: cloud-fine, hybrid-gated, or local-only, per section 16. The fourth is unit of scale: one assistant for one person, a workforce for a business, or a governed fleet for an enterprise.

A few concrete personas make the routing tangible. A freelance designer on a Mac who wants research, booking, and admin handled: Comet free, upgrade to ChatGPT Plus for Agent Mode when limits bite. A Windows-based finance analyst with spreadsheets and PDFs everywhere: Claude Cowork on Pro at $17/month, with Copilot Actions enabled as the OS layer matures. A two-person e-commerce brand drowning in supplier portals and listings: Skyvern for the recurring forms, a workforce platform like O-mega once the processes multiply. A hospital operations team: local-first stack or air-gapped Context deployment, nothing else clears legal. An engineering team automating QA flows: Agent S3 or Browser Use for control, Nova Act when the workflows harden into production fleets.

The most common buying mistake we see is over-purchasing autonomy: paying for a $200 tier to automate a task a $20 tier handles, or adopting a platform when a browser extension covers the actual need. Start at the cheapest tier that plausibly covers the job, instrument how often you hit its ceiling, and upgrade on evidence. The second most common mistake is under-purchasing accountability: adopting agents with no plan for verifying their output, which works right up until it very much does not (see section 17 and Qualcomm's 23% starting point).

20. Key Challenges and Limitations

Capability crossed the human baseline; reliability engineering did not come along automatically, and an honest guide has to hold both facts at once. The failure modes in July 2026 are well characterized. Long-horizon drift: success rates that look great per-task decay multiplicatively across chained tasks, so a 90%-reliable step still fails one time in three across a ten-step chain unless something verifies intermediate states. Prompt injection remains unsolved in the general case (section 15). Credential sprawl: every agent you adopt accumulates logins, and few organizations have any inventory of what their agents can access. Cost opacity: credit systems (Manus, Skyvern) and multi-attempt methods (bBoN) make monthly costs hard to predict in advance, which is precisely why Nova Act's transparent metering felt like a relief to operations teams.

There is also a labor-market limitation nobody prices into the demos: someone must own the agent's output. The Qualcomm 23%-to-98% arc took systematic human effort to build evals, review failures, and iterate. Anthropic's own usage data showing 33.4% of Cowork sessions on business process work means a third of usage now sits in workflows where errors have financial and legal consequences, and the review layer for that work is being invented company by company, unevenly. The strong claim we would defend from first principles: through at least 2027, the binding constraint on desktop-agent value is verification capacity, not model capability. Buy and build accordingly: prefer agents that expose their traces, keep humans on the consequential gates, and treat every autonomous workflow as unverified until its failure modes have been observed in production at least once.

21. Future Outlook

Extrapolating the visible curves, four developments look close to inevitable. Benchmark saturation: OSWorld's top scores sit at 85%+ against a 72% human baseline, and the field is already migrating to harder evaluations (CUAVerifierBench for judging trajectories, WebTailBench's Universal Verifier, longer-horizon economic tasks). Expect "OSWorld solved" headlines within a year and a new reference benchmark by 2027 - GitHub. OS-native agents by default: Windows 26H2 flips agent features on for Insiders in July 2026, and once agent accounts, contained workspaces, and audit trails ship at OS level, third-party agents will be pushed to run inside those primitives, the way apps were pushed into app-store sandboxes a decade ago. The $20 bundle war intensifies: agent capability is now a retention feature for the majors' subscriptions, which means continued price compression at the consumer tier and continued migration of frontier features down-tier, the pattern that took Agent Mode from $200 to $20 in a year.

The fourth development is the interesting one: the unit of purchase shifts from agent to outcome. Nova Act pricing by the agent-hour, workforce platforms selling processes rather than seats, and enterprises measuring agents by workflow accuracy all point the same direction: the market is groping toward paying for completed work rather than for access to a tool. When that transition completes, comparison guides like this one will rank not "agents" but standing services with SLAs, and the residual human role consolidates around specification and verification: deciding what is worth doing and confirming it was done. The through-line from our earliest coverage of AI agents as autonomous LLMs to this refresh is that every step of that shift arrived earlier than the consensus expected, and there is no structural reason for the next step to be different.

22. Conclusion

Eighteen months turned this category inside out: the two products that led the original ranking are dead, a $2B acquisition was unwound by a regulator, agents crossed the human baseline on the hardest desktop benchmark that exists, and the price of frontier agent capability fell an order of magnitude to $20 a month or free. The refreshed ranking reflects a market that finally has real products: Claude Cowork as the default general desktop agent, ChatGPT Agent Mode as the distribution king, Google's Chrome-embedded agents as the ambient option, Manus as the independent hybrid, workforce platforms like O-mega for process-level delegation, and a deep bench of metered, open-source, and enterprise tools behind them.

The decision framework compresses to three questions. Where does the work live (web, desktop, or process)? Where may the data go (cloud, gated, or local)? And who verifies the output (you, a gate, or an eval suite)? Answer those and the shortlist mostly picks itself from the table at the top of this guide. Start cheap, instrument your limits, upgrade on evidence, and put real thought into verification, because the gap between a 23% agent program and a 98% one is not the model you choose but the accountability you build around it.

We will keep refreshing this guide as the market rotates, because if this update proved anything, it is that a twelve-month-old ranking in this category is not outdated but fictional. The products above are what is real in July 2026.

This guide reflects the AI desktop automation landscape as of July 8, 2026. Pricing, availability, and benchmark figures change frequently in this market: verify current details on the linked official pages before purchasing.