Computer Use Agent: Costs, Safety, and When to Use One

Use a computer use agent when a necessary task has no usable API, a direct software interface, and you can check its result. Microsoft Copilot Studio charges 5 or 15 Copilot Credits per model step, but the budget that matters also includes supervision, retries, and the computer running the job. Microsoft's computer-use documentation defines that billing unit.

A supplier portal that only exports through a button is a plausible candidate. An old ERP, the software that holds orders and inventory, may need desktop control. A government form needs a much tighter boundary: preparing information and submitting a declaration are different jobs, even when the buttons sit beside each other.

The buying rule: choose the route with the narrowest access that can finish the work. A model that can click everything on a screen does not need permission to do everything your account can do.

What a Computer Use Agent Does

A computer use agent turns a visible interface into an action loop: see the screen, choose an action, click or type, inspect the changed screen, and continue. The model supplies the judgment; an executor, the software that carries out its commands, supplies the mouse and keyboard. OpenAI's current guide describes both structured computer actions and code that operates the interface. OpenAI computer use

That distinction explains the implementation work. Buying access to a model does not necessarily buy a running browser, a logged-in account, a scheduler, or a recovery process. Those pieces come from the product around it or from your application.

For a weekly supplier report, the agent might recognize the reports menu, select the requested period, and find Export even after the page layout changes. Whether it selected the correct supplier account and reporting period still needs verification. A downloaded file is evidence of a download, not evidence of a correct report.

Where a Computer Use AI Agent Fits

Use visual control for the part of the workflow that requires interpreting a screen. Once the report exists as a file, ordinary software can check its columns, read its dates, and move it to an approved destination. Keeping the agent on screen for those later steps adds decisions without necessarily adding value.

Browser-only control and full desktop control also differ. A browser can reach a web portal; it cannot automatically reach an ERP that only runs as a native Windows application. Decide which environment holds the work before comparing model brands.

What Has Changed for Buyers

The current choice is between developer tools, assistants you operate through a subscription, and an automation platform with its own billing meter. Their safety controls and bills are not interchangeable.

Verified against the makers' live documentation on 31 October 2026. This is documentation research and cost analysis, not an authenticated portal test or a benchmark.

Since October 30, 2026, Google's Gemini API Computer Use tool has been generally available across the Interactions and GenerateContent APIs. Since October 26, 2026, OpenAI's GPT-6.1 Terra has been available in the API, ChatGPT Work, and Codex. These releases widen the options for screen-only work; they do not remove the need to choose an execution environment and enforce approval boundaries. Google changelog, OpenAI API changelog, Work and Codex release

Compare the environment, billable unit, approval behavior, and who will own the workflow when it stops. Tokens meter the model's input and output, including encoded screenshots; they are not a count of completed actions. Model rankings are a separate decision; our multimodal models for computer-use agents article goes deeper into those tradeoffs.

OpenAI Computer Use Agent: API or ChatGPT Work?

OpenAI's Responses API computer use is the builder route when you want to own the execution environment. GPT-6.1 Terra is now a released option with computer-use support, and its tool calls use the Responses API. The current structured-action guide still demonstrates GPT-6.1 Sol; it also describes code execution with GPT-6 Astra through your runtime. Model availability and a working browser or desktop integration are separate decisions. Terra model documentation, current API guide

Billing: OpenAI charges for model input and output tokens, with separate cached-input and cache-write rates. The published Standard short-context rates for Terra and Sol appear in the cost table below. The current pricing table does not list a separate computer-click charge. Your execution environment and any other tools still need a budget. OpenAI API pricing

Safety: OpenAI directs builders to isolate the browser or virtual machine, restrict sites and actions, treat screen content as untrusted, and confirm consequential actions. A virtual machine is a separate software computer; its usefulness depends on what accounts, files, and networks you expose inside it. Put those restrictions in the executor, alongside instructions to the model. Execution and consent guidance

The hosted alternative: OpenAI's Agents API is in public beta and supplies an OpenAI-hosted browser. It requires approval for each new website origin, the address boundary used to identify a site. Site access approval does not enforce confirmation before individual actions. If an action must be technically impossible without approval, restrict the resources the browser can reach or use a runtime you control. API release status, hosted browser documentation

The Agents API bills model usage at API rates, tools at their standard rates, and hosted sandboxes at container rates. Do not transfer a model-only estimate to that route without adding its environment and tool usage. Agents API pricing rules

ChatGPT Work: the Current Route for a Non-Developer

ChatGPT Work cloud browser delegates website tasks to a separate computer in the cloud. It is available on paid plans other than Free and Go, subject to rollout and workspace settings; Enterprise admins must enable it. Website sign-in is documented for Plus and Pro on web and mobile, subject to rollout, and is unavailable in Enterprise and Edu workspaces. Do not assume every paid workspace can sign in to your supplier portal. Our ChatGPT comparison covers the broader product choice. Browser availability

Billing: ChatGPT Work and Codex share subscription usage. Eligible usage beyond included limits can draw from purchased credits; credit-based billing depends on the model and agreement. API token prices are separate from subscription usage, so the API table below is not a Work subscription rate card. Neither meter supplies a universal dollar price per download. Work and Codex pricing

Safety: Cloud browser asks for new-site access by default, offers site allow/block settings, and is designed to request confirmation for consequential actions. Where sign-in is available, use the secure form so credentials go directly to the browser rather than the model. Website operators can still block automated access. A portal working in your own browser does not establish that it will work in the cloud browser. Cloud browser controls

For local apps, use the desktop Computer Use plugin. ChatGPT Work and Codex can operate macOS and Windows interfaces in supported regions. Review app permissions; macOS also requires Screen Recording and Accessibility access. Windows control takes over the active desktop, so it cannot run in the background while you use that same session. You can stop or take over the task, and revoke saved app permissions. Desktop setup and controls

Terra is available on Plus, Pro, Business, Enterprise, and Edu, subject to workspace controls. Its availability in Work on mobile does not mean it controls native apps on your phone: the documented desktop executor operates macOS or Windows, while cloud-browser tasks run on OpenAI's separate computer. For a signed-in local website, the Chrome extension can use your existing browser session. Terra availability, Chrome extension

Choose a supported Work browser or desktop route for an operator-led workflow whose result can be reviewed. Choose an API integration when the job needs application-enforced stopping points, structured logs, or a recovery process your business owns.

Anthropic: Computer Use Tool or Claude in Chrome?

Anthropic's computer use tool gives Claude screen and input actions while your application runs the calls. The current client toolset is available through the standard Claude Messages API without a beta header, can return several actions in a turn, and supports Claude Sonnet 5.5 among other models. Earlier tool versions and some cloud-platform routes remain beta. It is not currently available inside Claude Managed Agents, so do not assume that product supplies the desktop. Anthropic computer-use documentation

Billing: Anthropic uses standard tool-use token pricing. The default current toolset adds about 4,500 input tokens, and screenshots and tool results consume additional input. The cost table below lists Claude Sonnet 5.5's base rates. Repeated screen observations and conversation history are why a task costs more than its initial instruction suggests. Tool costs, model prices

Safety: Anthropic scans tool returns such as screenshots for suspected prompt injection, meaning instructions placed in page content to redirect the agent. Detection steers Claude to check whether the instruction came from the user. Anthropic still calls for isolation from sensitive data and actions, plus user consent. The classifier is a safeguard, not a substitute for your permission boundary. As the builder, restrict the sites reachable from the execution environment. Computer-use security

For a job confined to webpages, Anthropic points to its separate browser use tool, which can work with page structure as well as screenshots. Do not build a full desktop merely because the portal has no API. Browser use tool

Our multi-action computer-use cost analysis explains the economics of grouping actions. The practical limit is simple: do not batch past a point where a person must inspect the state and approve what happens next.

Claude in Chrome: Shared Plan Usage, Browser Permissions

Claude in Chrome is Anthropic's browser extension for reading, clicking, and navigating websites alongside you. It is available on Pro, Max, Ultra, Team, and Enterprise plans. The side panel runs as a Cowork session, with availability still varying by rollout. On Enterprise, an owner must enable Claude in Chrome and Cowork in the cloud, or the classic experience remains. Claude in Chrome setup

Billing: Chrome tasks share the usage limits of your Claude plan with Claude and Claude Code. Browser interactions consume more usage than regular chats. There is no stated fixed fee per downloaded report. Chrome usage limits

Safety: The Cowork side panel defaults to Automatically approve: it reviews actions for safety and pauses when needed. Switch to Manually approve for a supervised workflow; Cowork asks per action, while the classic panel starts with a plan approval. Downloads remain protected in the documented manual workflow. Skip all approvals removes pauses and automatic action checks. Purchases, account creation, permanent deletion, and untrusted downloads are prohibited; organizations can apply site allowlists and blocklists. Choose the mode deliberately before starting. Chrome permissions

The extension's access to your browser is useful, but it also puts signed-in data within reach. Anthropic recommends a separate profile and advises against sensitive or regulated pages. For a supplier portal containing confidential company or personal data, resolve that suitability question before choosing this route. Chrome safety guidance

Microsoft Copilot Studio: Windows Work With a Step Meter

Microsoft Copilot Studio computer use is the natural candidate when the job crosses Windows desktop apps and websites. The core tool is generally available and operates through an agent using generative orchestration, the system that selects and coordinates its tools. Its hosted browser and Cloud PC pool options are separately labeled preview. The hosted browser is not recommended for production and does not support custom desktop apps, so it is not a substitute for a configured machine running your old ERP. Core availability, execution options

Billing: Microsoft's unit is a model step: 5 Copilot Credits for a standard model or 15 for a premium model. A step can contain multiple clicks or other low-level actions. Therefore, counting buttons in your procedure will not predict the bill. Computer-use licensing

Safety: Enable access control to restrict websites and apps; it is not restricted by default. Microsoft says this blocks interactions outside the list, but does not prevent those sites from being opened. Use a dedicated, isolated machine and review which identity the connection uses. Access controls

The human-supervision feature can request clarification, but Microsoft explicitly says these requests are probabilistic and are not a guaranteed safety stop or enforcement of your custom rules. A purchasing approval therefore needs a separately enforced workflow boundary. A sentence telling the model to ask is insufficient. Human-supervision limitations

For a mid-market CTO, the attraction is operating within an existing Windows and automation estate. The work to budget is machine administration, permissions, and exception handling as well as credits. For a founder with a browser-only report, that may be more infrastructure than the task warrants.

Google and Amazon Offer Additional Developer Routes

Google Gemini Computer Use

Google Gemini Computer Use is now generally available for browser, mobile, and desktop agents through an executor you implement. Google's current guide recommends Gemini 3.8 Flash and also supports Gemini 4 Argon. The GA label applies to the tool; your application still has to run its actions, return screenshots, and handle approvals. Gemini Computer Use

Billing: Google charges Computer Use as regular tokens at the selected model's rates. The tool is unavailable on the free tier. The cost table below lists Gemini 3.8 Flash's Standard paid rates and their scheduled change; those rates include output thinking tokens. Gemini pricing

Safety: The client must honor confirmation requests and blocked actions. Google recommends a sandbox and navigation allow/block lists; screenshot-based prompt-injection detection is opt-in and defaults off. Enable the controls intentionally rather than assuming the tool declaration supplied them. Gemini safety controls

This is another builder option, not a ready-to-run operations employee. Its attractive token line does not price your browser hosting or review process.

Amazon Nova Act

Amazon Nova Act is generally available and combines natural-language browser actions with Python workflow orchestration. It is worth considering when your builder wants explicit program logic around the agent's browser work. This is a browser route, not a claim of native desktop or mobile-app control. Nova Act overview, GA announcement

Billing: AWS lists “$4.75 per agent hour.” That is elapsed time while the agent works; parallel agents each generate usage. Waiting for a human is excluded when you implement its human-in-the-loop mechanism. The task formula is active agent-hours multiplied by $4.75, before any separately incurred infrastructure costs. Nova Act pricing

Safety: The SDK supports URL restrictions through state guardrails and blocks local file access and uploads unless paths are allowed. Human approval is functionality you implement with the SDK, not a managed reviewer service. Keep the surrounding browser environment constrained too; a URL rule does not grant a task permission. SDK security, human-in-the-loop implementation

What Does It Cost Per Task?

There is no defensible universal price per portal download. The makers meter tokens, steps, active time, or shared subscription usage. A per-task quote needs the actual workflow and an agreed definition of completion.

Compare the makers' published rates before estimating your workflow. These are prices for metered usage, not quotes for a completed report.

These published rates do not establish equal task effort, speed, or reliability. Cache pricing, other tools, execution, and review are separate considerations. Use total metered tokens across the run, including charged history and screenshots, rather than counting the words in your starting prompt.

Microsoft provides a different worked example: a timesheet workflow taking four model steps consumes 20 standard or 60 premium credits. Its documented pay-as-you-go rate is $0.01 per Copilot Credit. That is Microsoft's timesheet example, not a prediction that your portal takes four steps. Step example, credit price

A subscription assistant needs different accounting. Its marginal cash charge may be covered by your remaining allowance while still consuming capacity you need for other work. Dividing a subscription by an advertised message limit would also confuse a request with a successfully checked report.

Budget the Accepted Result

Use this operating calculation:

Cost per accepted report = (all run charges + allocated execution costs + human review and recovery costs) ÷ accepted reports.

Include failed runs in the numerator. Accept a report only after the account, period, file contents, and destination meet the requirements. Otherwise a low cost per attempted download rewards the wrong behavior.

For a weekly task, the labor comparison is equally concrete: manual handling time minus approval, checking, and recovery time. Multiply the time actually saved by your own loaded labor rate, then subtract the automation's costs. If the result does not cover ongoing maintenance and setup over your chosen payback period, keep the manual process or use simpler automation.

No labor rate, success percentage, or completion time is assumed here. Those are measurements the business must supply; a vendor token price cannot establish them.

When an API, MCP Server, or Browser Automation Is Better

Use a direct route whenever it can perform the exact operation you need. An API, an interface software can call without navigating screens, is usually the first place to look. Ask the supplier about report endpoints, scheduled exports, or supported file delivery before commissioning a visual agent.

An MCP server, using Model Context Protocol, exposes tools and data to an AI application through a common interface. It may wrap an API, or it may drive a browser. MCP is therefore not automatically an alternative to computer use: the tool behind it decides how the work happens. MCP architecture

Prefer a task-specific MCP tool when it exposes the permitted operation directly, such as retrieving an approved report. That can give the model a smaller action space than an entire screen. It cannot conjure an export function the supplier never exposed.

Prefer a maintained browser script when the same stable controls and validations repeat. A script can select the period and wait for the download without asking a model to reinterpret every step. It still needs maintenance and checks; the advantage is making known behavior explicit.

Use an agent with browser tools when the route needs judgment but the page exposes useful structure. Microsoft Playwright MCP uses accessibility snapshots, a structured representation of page controls, rather than requiring screenshot interpretation. Its maintainers also state that it is not a security boundary. Our Playwright MCP setup and limits guide explains the practical tradeoffs. Official Playwright MCP repository

Use visual computer control when the task depends on a native app, a visual interface without useful structure, or navigation that cannot reasonably be captured in the direct tools available to you. Keep it to that segment, then hand the file back to ordinary software.

Worked Example: Download a Weekly Supplier Report

The safest useful starting point is a retrieval workflow with a checked output and a human-owned release. The following is an illustrative design for a supplier portal, not a report of a signed-in test. It assumes the portal permits the workflow, the data is suitable for the chosen product, and the account can export the report.

The objective is specific: retrieve the agreed weekly delivery report for the approved supplier account and completed reporting period, save it to a staging folder, and leave business records unchanged.

1. 1

   Approve the scope and access

   The operator identifies the exact portal address, account, reporting period, report type, and staging destination. The account should have only the access needed for this job. The human approves that scope before the first run. A new supplier account or destination requires renewed review rather than being inferred from page text.

2. 2

   Authenticate through the product's approved path

   The human completes sign-in or multifactor authentication when required. If your ChatGPT Work plan and rollout support cloud website sign-in, use the secure sign-in form rather than putting credentials in chat. Otherwise choose a supported local browser or desktop route before scheduling the task. In an API implementation, keep credential handling outside the model prompt. If the portal presents a CAPTCHA, unexpected login destination, or access block, stop for the operator; do not treat it as an obstacle the agent is authorized to bypass.

3. 3

   Navigate and stage the report selection

   The agent opens Reports, selects the approved report and period, and captures the selected state. It must stop if the period is ambiguous, the account differs, or the expected report is missing. The model may read a button label, but it must not treat a banner telling it to upload data elsewhere as a new instruction.

4. 4

   Get human approval before downloading

   Present the account, report name, date range, source, and destination to the operator. Pause until they approve. In Claude in Chrome, select Manually approve before starting; the Cowork side panel's default is automatic approval. In a custom implementation, make the pause an enforced application checkpoint. Copilot Studio's probabilistic supervision alone does not guarantee it.

5. 5

   Download to staging and validate the file

   The agent initiates the approved download. Check that a file arrived and is the expected format, then inspect the account and reporting period inside it. Where the export has a known schema, validate its required columns with ordinary software. An empty report may be legitimate; do not invent missing rows to make a check pass.

6. 6

   Approve release and record the outcome

   The human reviews the validation result before the file moves into the folder used by the business. This release gate is part of our proposed workflow, not a claim that every vendor supplies it. Record the accepted file, source, period, interventions, metered usage, and any failed attempt. A mismatched report stays in staging for review.

The sign-in and download behaviors above follow the relevant OpenAI cloud-browser and Anthropic permissions documentation. The additional scope, validation, and release gates are our workflow design.

A weekly schedule should start the procedure, not grant fresh permission to change its scope. Build it so an expired login, changed report, missing file, or approval request can wait for a person without silently substituting another task.

For a government form, stop earlier: preparation can be separated from filing. For an ERP, restrict the initial job to retrieval if possible. A workflow that can post inventory adjustments or submit declarations deserves a different authorization design from a download.

What Is Overhyped?

“No API needed” describes access, not dependability. The screen path still needs authentication, permitted automation, a usable interface, and a way to recognize the correct result. An agent may recover from a moved button while missing that the portal reset the date filter.

“It asks when necessary” is weaker than an enforced approval. OpenAI's hosted API distinguishes site permission from action confirmation; Microsoft says human-supervision requests are not guaranteed. The implication for a buyer is concrete: ask the implementer to show where a forbidden action is prevented, not merely where the prompt says to avoid it.

“A task costs a few cents” can omit the expensive part. A retry that requires someone to open the run, understand the state, and recover it consumes labor even when the model bill is small. The useful comparison is accepted output at a known review burden.

“Works with any app” is not an acceptance test. A demonstration on a sample form does not prove compatibility with your supplier's login, report selector, or file export. Require evidence for the workflow you intend to buy, and keep that evidence separate from vendor benchmarks.

Who Should Act Now, and Who Should Wait?

Operators: start with an approved retrieval job whose output you already know how to verify. Keep an operator responsible for exceptions. If the job takes less effort manually than supervising the automation, the adoption case is weak.

Builders: start at the narrowest integration and add screen control only where it is necessary. Own the stopping conditions, logs, validation, and recovery procedure. The model is a component; the maintained workflow is the deliverable.

Founders and buyers: require a quote that separates setup, recurring software, execution, and review. Ask what happens after a portal change and who pays for recovery. Wait when the proposed workflow can make consequential changes but its only approval mechanism is a natural-language instruction.

Teams already served by an API or reliable export: you may be unaffected. There is no operational prize for replacing a dependable integration with extra screen navigation.

Questions an Operator Will Ask

Can it use our supplier portal if the portal has no API?

Possibly, if the chosen product can reach and operate that portal, the site permits the workflow, and the task has a checkable result. Lack of an API establishes the need for another access route; it does not establish browser compatibility or permission to automate.

Can it run every week without me signing in again?

That depends on session persistence and the portal's authentication policy. Design the schedule to pause when authentication or approval is needed. Do not promise unattended completion just because a product can schedule a task.

Which is the best computer use agent for an old Windows ERP?

Begin with the required environment. Copilot Studio supports configured Windows machines; a developer-controlled computer-use integration can supply its own desktop environment. A browser-only assistant is appropriate only if the ERP workflow is available in its supported browser. Then compare permissions, recovery ownership, and accepted-result cost.

Can the agent submit a government form after filling it in?

Do not infer submission authority from permission to prepare the form. Keep a human review of the exact information and declaration, honor the chosen product's restrictions, and require an explicit release boundary. If that boundary cannot be enforced, have the person complete the submission.

Your Monday move: write down the supplier account, reporting period, allowed destination, acceptance checks, and approval owner for the weekly download. Have the workflow owner check for a supported export or integration before scoping a supervised screen-based implementation.

For more practical AI adoption decisions, join the newsletter.