Computer Use Agent: Costs, Safety, and When to Use One

Use a computer use agent when a necessary task has no usable API, a direct software interface, and you can check its result. Microsoft Copilot Studio charges 5 or 15 Copilot Credits per model step, but the budget that matters also includes supervision, retries, and the computer running the job. Microsoft's computer-use documentation defines that billing unit.

A supplier portal that only exports through a button is a plausible candidate. An old ERP, the software that holds orders and inventory, may need desktop control. A government form needs a much tighter boundary: preparing information and submitting a declaration are different jobs, even when the buttons sit beside each other.

The buying rule: choose the route with the narrowest access that can finish the work. A model that can click everything on a screen does not need permission to do everything your account can do.

What a Computer Use Agent Does

A computer use agent turns a visible interface into an action loop: see the screen, choose an action, click or type, inspect the changed screen, and continue. The model supplies the judgment; an executor, the software that carries out its commands, supplies the mouse and keyboard. OpenAI's current guide describes both structured computer actions and code that operates the interface. OpenAI computer use

That distinction explains the implementation work. Buying access to a model does not necessarily buy a running browser, a logged-in account, a scheduler, or a recovery process. Those pieces come from the product around it or from your application.

For a weekly supplier report, the agent might recognize the reports menu, select the requested period, and find Export even after the page layout changes. Whether it selected the correct supplier account and reporting period still needs verification. A downloaded file is evidence of a download, not evidence of a correct report.

Where a Computer Use AI Agent Fits

Use visual control for the part of the workflow that requires interpreting a screen. Once the report exists as a file, ordinary software can check its columns, read its dates, and move it to an approved destination. Keeping the agent on screen for those later steps adds decisions without necessarily adding value.

Browser-only control and full desktop control also differ. A browser can reach a web portal; it cannot automatically reach an ERP that only runs as a native Windows application. Decide which environment holds the work before comparing model brands.

What Has Changed for Buyers

The current choice is between developer tools, assistants you operate through a subscription, and an automation platform with its own billing meter. Their safety controls and bills are not interchangeable.

Verified against the makers' live documentation on 13 October 2026. This is documentation research and cost analysis, not an authenticated portal test or a benchmark.

The most consequential naming change is OpenAI's: its ChatGPT agent help page now says the product is no longer available and directs readers to ChatGPT Work and cloud browser. Older plan and message-limit text remains further down that page. Do not budget a new deployment from those legacy limits. ChatGPT agent status

Compare the environment, billable unit, approval behavior, and who will own the workflow when it stops. Tokens meter the model's input and output, including encoded screenshots; they are not a count of completed actions. Model rankings are a separate decision; our multimodal models for computer-use agents article goes deeper into those tradeoffs.

OpenAI Computer Use Agent: API or ChatGPT Work?

OpenAI's Responses API computer use is the builder route when you want to own the execution environment. The current structured-action example uses GPT-6.1 Sol. OpenAI also recommends a code-execution integration for GPT-6 Astra, where generated code operates the interface through your runtime. These are integration choices, not different subscription plans. Current API guide

Billing: OpenAI labels model pricing “Prices per 1M tokens.” GPT-6.1 Sol's Standard short-context rates are $2 input and $10 output per million tokens, with separate cached-input and cache-write rates. These are model costs, not a price for a completed portal task. The current pricing table does not list a separate computer-click charge; its $2.50-per-thousand tool-call row belongs to file search. OpenAI API pricing

Safety: OpenAI directs builders to isolate the browser or virtual machine, restrict sites and actions, treat screen content as untrusted, and confirm consequential actions. A virtual machine is a separate software computer; its usefulness depends on what accounts, files, and networks you expose inside it. Put those restrictions in the executor, alongside instructions to the model. Execution and consent guidance

The hosted alternative: OpenAI's Agents API supplies a browser and requires approval for each new website origin, the address boundary used to identify a site. Its documentation makes a critical distinction: site access approval does not enforce confirmation before individual actions. If an action must be technically impossible without approval, restrict the resources the browser can reach or use a runtime you control. Hosted browser documentation

The Agents API bills model usage at API rates, tools at their standard rates, and hosted sandboxes at container rates. Do not transfer a model-only estimate to that route without adding its environment and tool usage. Agents API pricing rules

ChatGPT Work: the Current Route for a Non-Developer

ChatGPT Work cloud browser is the relevant current OpenAI product for delegating supported website tasks. It uses a separate computer in the cloud rather than your existing browser session. Access depends on supported paid plans, region, and workspace permissions. Cloud browser documentation

Billing: For eligible personal plans, OpenAI says included usage is used first; excess supported usage can draw from purchased credits. Work can share that allowance with other agentic features. Business and Enterprise credit-based Work pricing is token-based, with rates that depend on the model and agreement. Neither rule provides a universal dollar price per download. Personal usage rules, business credit rate card

Safety: Cloud browser asks for new-site access by default, offers site allow/block settings, and is designed to request confirmation for consequential actions. Sign-in uses a secure form; website operators can still block automated access. A supplier portal working in your own browser does not establish that it will work in this cloud browser. Cloud browser controls

Choose this route for an operator-led workflow whose result can be reviewed. Choose an API integration when the job needs application-enforced stopping points, structured logs, or a recovery process your business owns.

Anthropic: Computer Use Tool or Claude in Chrome?

Anthropic's computer use tool gives Claude screen and input actions while your application runs the calls. The current client toolset can return several actions in a turn, and supports Claude Sonnet 5.5 among other models. It is not currently available inside Claude Managed Agents. That last distinction matters if you assumed a managed product would also supply the desktop. Anthropic computer-use documentation

Billing: Anthropic says computer use follows standard tool-use pricing. The default current toolset adds about 4,500 input tokens, and screenshots and tool results consume additional input. Claude Sonnet 5.5's base price is $2 input and $10 output per million tokens. Repeated screen observations and conversation history are why a task costs more than its initial instruction suggests. Tool costs, model prices

Safety: Anthropic scans tool returns such as screenshots for suspected prompt injection, meaning instructions placed in page content to redirect the agent. Detection steers Claude to check whether the instruction came from the user. Anthropic still calls for isolation from sensitive data and actions, plus user consent. The classifier is a safeguard, not a substitute for your permission boundary. As the builder, restrict the sites reachable from the execution environment. Computer-use security

For a job confined to webpages, Anthropic points to its separate browser use tool, which can work with page structure as well as screenshots. Do not build a full desktop merely because the portal has no API. Browser use tool

Our multi-action computer-use cost analysis explains the economics of grouping actions. The practical limit is simple: do not batch past a point where a person must inspect the state and approve what happens next.

Claude in Chrome: Shared Plan Usage, Browser Permissions

Claude in Chrome is Anthropic's browser extension for reading, clicking, and navigating websites alongside you. It is available on Pro, Max, Team, and Enterprise plans. The Chrome side panel is in beta, and its Cowork experience varies with rollout and administrator settings. Claude in Chrome setup

Billing: Anthropic says Chrome use will “count against the same plan limits” as Claude or Claude Code. Browser interactions consume more usage than regular chats; Automatically approve mode uses additional allowance for safety checks. There is no stated fixed fee per downloaded report. Chrome usage limits

Safety: In Manually approve mode, review the planned access and actions. The permissions guide protects downloads even when a site has ongoing permission, and requires permission for sensitive information and authorizations. Purchases, account creation, permanent deletion, and untrusted downloads are among the prohibited actions. Organizations can apply site allowlists and blocklists. Modes differ, so do not assume an unattended mode preserves every manual checkpoint. Chrome permissions

The extension's access to your browser is useful, but it also puts signed-in data within reach. Anthropic recommends a separate profile and advises against sensitive or regulated pages. For a supplier portal containing confidential company or personal data, resolve that suitability question before choosing this route. Chrome safety guidance

Microsoft Copilot Studio: Windows Work With a Step Meter

Microsoft Copilot Studio computer use is the natural candidate when the job crosses Windows desktop apps and websites. It operates a configured machine through an agent using generative orchestration, the system that selects and coordinates its tools. Microsoft computer use

Billing: Microsoft's unit is a model step: 5 Copilot Credits for a standard model or 15 for a premium model. A step can contain multiple clicks or other low-level actions. Therefore, counting buttons in your procedure will not predict the bill. Computer-use licensing

Safety: Enable access control to restrict websites and apps; it is not restricted by default. Microsoft says this blocks interactions outside the list, but does not prevent those sites from being opened. Use a dedicated, isolated machine and review which identity the connection uses. Access controls

The human-supervision feature can request clarification, but Microsoft explicitly says these requests are probabilistic and are not a guaranteed safety stop or enforcement of your custom rules. A purchasing approval therefore needs a separately enforced workflow boundary. A sentence telling the model to ask is insufficient. Human-supervision limitations

For a mid-market CTO, the attraction is operating within an existing Windows and automation estate. The work to budget is machine administration, permissions, and exception handling as well as credits. For a founder with a browser-only report, that may be more infrastructure than the task warrants.

Google and Amazon Offer Additional Developer Routes

Google Gemini Computer Use

Google Gemini Computer Use supports browser, mobile, and desktop environments through an executor you implement. Google's current guide recommends Gemini 3.8 Flash. Gemini Computer Use

Billing: Google describes Computer Use as “Charged as regular tokens per model pricing.” Gemini 3.8 Flash Standard paid pricing is $0.75 input and $3.75 output, including thinking, per million tokens through December 31, 2026. The page lists $1.50 and $7.50 from January 1, 2027. Computer Use itself is unavailable on the free tier. Gemini pricing

Safety: The client must honor confirmation requests and blocked actions. Google recommends a sandbox and navigation allow/block lists; screenshot-based prompt-injection detection is opt-in and defaults off. Enable the controls intentionally rather than assuming the tool declaration supplied them. Gemini safety controls

This is another builder option, not a ready-to-run operations employee. Its attractive token line does not price your browser hosting or review process.

Amazon Nova Act

Amazon Nova Act combines natural-language browser actions with Python workflow orchestration. It is worth considering when your builder wants explicit program logic around the agent's browser work. Nova Act overview

Billing: AWS lists “$4.75 per agent hour.” That is elapsed time while the agent works; parallel agents each generate usage. Waiting for a human is excluded when you implement its human-in-the-loop mechanism. The task formula is active agent-hours multiplied by $4.75, before any separately incurred infrastructure costs. Nova Act pricing

Safety: The SDK supports URL restrictions through state guardrails and blocks local file access and uploads unless paths are allowed. Human approval is functionality you implement with the SDK, not a managed reviewer service. Keep the surrounding browser environment constrained too; a URL rule does not grant a task permission. SDK security, human-in-the-loop implementation

What Does It Cost Per Task?

There is no defensible universal price per portal download. The makers meter tokens, steps, active time, or shared subscription usage. A per-task quote needs the actual workflow and an agreed definition of completion.

For a transparent illustration, borrow the 50,000 input-token and 15,000 output-token shape from Anthropic's published billing example. That example is not a computer-use measurement; it is simply a documented quantity on which to do arithmetic. Assume ordinary uncached input, no cache writes, and no added tools or hosting. Source of the illustrative token quantities

These are our calculations from the cited OpenAI, Anthropic, and Google rates. Equal token quantities do not establish equal task effort, speed, or reliability. Use total metered tokens across the run, including charged history and screenshots, rather than counting the words in your starting prompt.

Microsoft provides a different worked example: a timesheet workflow taking four model steps consumes 20 standard or 60 premium credits. At its documented pay-as-you-go price of $0.01 per credit, those become $0.20 or $0.60 for the computer-use steps. That is Microsoft's timesheet example, not a prediction that your portal takes four steps. Step example, credit price

A subscription assistant needs different accounting. Its marginal cash charge may be covered by your remaining allowance while still consuming capacity you need for other work. Dividing a subscription by an advertised message limit would also confuse a request with a successfully checked report.

Budget the Accepted Result

Use this operating calculation:

Cost per accepted report = (all run charges + allocated execution costs + human review and recovery costs) ÷ accepted reports.

Include failed runs in the numerator. Accept a report only after the account, period, file contents, and destination meet the requirements. Otherwise a low cost per attempted download rewards the wrong behavior.

For a weekly task, the labor comparison is equally concrete: manual handling time minus approval, checking, and recovery time. Multiply the time actually saved by your own loaded labor rate, then subtract the automation's costs. If the result does not cover ongoing maintenance and setup over your chosen payback period, keep the manual process or use simpler automation.

No labor rate, success percentage, or completion time is assumed here. Those are measurements the business must supply; a vendor token price cannot establish them.

When an API, MCP Server, or Browser Automation Is Better

Use a direct route whenever it can perform the exact operation you need. An API, an interface software can call without navigating screens, is usually the first place to look. Ask the supplier about report endpoints, scheduled exports, or supported file delivery before commissioning a visual agent.

An MCP server, using Model Context Protocol, exposes tools and data to an AI application through a common interface. It may wrap an API, or it may drive a browser. MCP is therefore not automatically an alternative to computer use: the tool behind it decides how the work happens. MCP architecture

Prefer a task-specific MCP tool when it exposes the permitted operation directly, such as retrieving an approved report. That can give the model a smaller action space than an entire screen. It cannot conjure an export function the supplier never exposed.

Prefer a maintained browser script when the same stable controls and validations repeat. A script can select the period and wait for the download without asking a model to reinterpret every step. It still needs maintenance and checks; the advantage is making known behavior explicit.

Use an agent with browser tools when the route needs judgment but the page exposes useful structure. Microsoft Playwright MCP uses accessibility snapshots, a structured representation of page controls, rather than requiring screenshot interpretation. Its maintainers also state that it is not a security boundary. Our Playwright MCP setup and limits guide explains the practical tradeoffs. Official Playwright MCP repository

Use visual computer control when the task depends on a native app, a visual interface without useful structure, or navigation that cannot reasonably be captured in the direct tools available to you. Keep it to that segment, then hand the file back to ordinary software.

Worked Example: Download a Weekly Supplier Report

The safest useful starting point is a retrieval workflow with a checked output and a human-owned release. The following is an illustrative design for a supplier portal, not a report of a signed-in test. It assumes the portal permits the workflow, the data is suitable for the chosen product, and the account can export the report.

The objective is specific: retrieve the agreed weekly delivery report for the approved supplier account and completed reporting period, save it to a staging folder, and leave business records unchanged.

1. 1

   Approve the scope and access

   The operator identifies the exact portal address, account, reporting period, report type, and staging destination. The account should have only the access needed for this job. The human approves that scope before the first run. A new supplier account or destination requires renewed review rather than being inferred from page text.

2. 2

   Authenticate through the product's approved path

   The human completes sign-in or multifactor authentication when required. In ChatGPT Work, use the secure sign-in flow rather than putting credentials in chat. In an API implementation, keep credential handling outside the model prompt. If the portal presents a CAPTCHA, unexpected login destination, or access block, stop for the operator; do not treat it as an obstacle the agent is authorized to bypass.

3. 3

   Navigate and stage the report selection

   The agent opens Reports, selects the approved report and period, and captures the selected state. It must stop if the period is ambiguous, the account differs, or the expected report is missing. The model may read a button label, but it must not treat a banner telling it to upload data elsewhere as a new instruction.

4. 4

   Get human approval before downloading

   Present the account, report name, date range, source, and destination to the operator. Pause until they approve. In Claude in Chrome's manual workflow, this aligns with the documented download permission. In a custom implementation, make it an enforced application checkpoint. Copilot Studio's probabilistic supervision alone does not guarantee this pause.

5. 5

   Download to staging and validate the file

   The agent initiates the approved download. Check that a file arrived and is the expected format, then inspect the account and reporting period inside it. Where the export has a known schema, validate its required columns with ordinary software. An empty report may be legitimate; do not invent missing rows to make a check pass.

6. 6

   Approve release and record the outcome

   The human reviews the validation result before the file moves into the folder used by the business. This release gate is part of our proposed workflow, not a claim that every vendor supplies it. Record the accepted file, source, period, interventions, metered usage, and any failed attempt. A mismatched report stays in staging for review.

The sign-in and download behaviors above follow the relevant OpenAI cloud-browser and Anthropic permissions documentation. The additional scope, validation, and release gates are our workflow design.

A weekly schedule should start the procedure, not grant fresh permission to change its scope. Build it so an expired login, changed report, missing file, or approval request can wait for a person without silently substituting another task.

For a government form, stop earlier: preparation can be separated from filing. For an ERP, restrict the initial job to retrieval if possible. A workflow that can post inventory adjustments or submit declarations deserves a different authorization design from a download.

What Is Overhyped?

“No API needed” describes access, not dependability. The screen path still needs authentication, permitted automation, a usable interface, and a way to recognize the correct result. An agent may recover from a moved button while missing that the portal reset the date filter.

“It asks when necessary” is weaker than an enforced approval. OpenAI's hosted API distinguishes site permission from action confirmation; Microsoft says human-supervision requests are not guaranteed. The implication for a buyer is concrete: ask the implementer to show where a forbidden action is prevented, not merely where the prompt says to avoid it.

“A task costs a few cents” can omit the expensive part. A retry that requires someone to open the run, understand the state, and recover it consumes labor even when the model bill is small. The useful comparison is accepted output at a known review burden.

“Works with any app” is not an acceptance test. A demonstration on a sample form does not prove compatibility with your supplier's login, report selector, or file export. Require evidence for the workflow you intend to buy, and keep that evidence separate from vendor benchmarks.

Who Should Act Now, and Who Should Wait?

Operators: start with an approved retrieval job whose output you already know how to verify. Keep an operator responsible for exceptions. If the job takes less effort manually than supervising the automation, the adoption case is weak.

Builders: start at the narrowest integration and add screen control only where it is necessary. Own the stopping conditions, logs, validation, and recovery procedure. The model is a component; the maintained workflow is the deliverable.

Founders and buyers: require a quote that separates setup, recurring software, execution, and review. Ask what happens after a portal change and who pays for recovery. Wait when the proposed workflow can make consequential changes but its only approval mechanism is a natural-language instruction.

Teams already served by an API or reliable export: you may be unaffected. There is no operational prize for replacing a dependable integration with extra screen navigation.

Questions an Operator Will Ask

Can it use our supplier portal if the portal has no API?

Possibly, if the chosen product can reach and operate that portal, the site permits the workflow, and the task has a checkable result. Lack of an API establishes the need for another access route; it does not establish browser compatibility or permission to automate.

Can it run every week without me signing in again?

That depends on session persistence and the portal's authentication policy. Design the schedule to pause when authentication or approval is needed. Do not promise unattended completion just because a product can schedule a task.

Which is the best computer use agent for an old Windows ERP?

Begin with the required environment. Copilot Studio supports configured Windows machines; a developer-controlled computer-use integration can supply its own desktop environment. A browser-only assistant is appropriate only if the ERP workflow is available in its supported browser. Then compare permissions, recovery ownership, and accepted-result cost.

Can the agent submit a government form after filling it in?

Do not infer submission authority from permission to prepare the form. Keep a human review of the exact information and declaration, honor the chosen product's restrictions, and require an explicit release boundary. If that boundary cannot be enforced, have the person complete the submission.

Your Monday move: write down the supplier account, reporting period, allowed destination, acceptance checks, and approval owner for the weekly download. Have the workflow owner check for a supported export or integration before scoping a supervised screen-based implementation.

For more practical AI adoption decisions, join the newsletter.