Computer-use and browser agents are AI agents that operate a screen the way a person does, reading pages or desktops from screenshots and then clicking, typing and navigating, and every major AI provider now ships at least one. This page sets out the main products as of 15 November 2026, both the consumer and workplace agents people use directly and the developer tools that let teams build their own, with the same fields for each: provider, status, plans, platforms, capabilities, permission controls and data handling. It is written for IT and security teams deciding what to allow, for developers choosing a toolkit and for anyone trying to understand what these agents can do. Products are listed alphabetically within each group; order is never a ranking. Every fact comes from the provider's own documentation, and where a provider does not publish a fact the page says so.
Last checked: 2026-11-15.
This is an independent reference page from NHI Mgmt Group based on public provider documentation; it is not sponsored or endorsed by any provider. Agent products change quickly, so confirm details against each provider's current documentation, linked in the sources list.
Key takeaways
- Two kinds of product. Consumer and workplace agents (ChatGPT agent, Claude computer use in Cowork, Claude in Chrome, Comet, Gemini Tasks) act for a signed-in person; developer tools (Amazon Bedrock AgentCore Browser, the Claude computer use tool, Gemini API Computer Use, Copilot Studio computer use, OpenAI computer use in the Responses API) are building blocks for your own agents.
- Confirmation steps are widely documented. ChatGPT agent, Claude computer use, Claude in Chrome and Gemini Tasks document actions they pause on or refuse, such as purchases, sending messages, entering sensitive data or financial transactions, and the Anthropic, Google, Microsoft and OpenAI developer tools document a confirmation or approval mechanism.
- Prompt injection is the shared, documented risk. Anthropic, Google, Microsoft and OpenAI all warn that instructions on web pages or in screenshots can steer the agent, and recommend isolated environments, allowlists and human confirmation.
- Retention is rarely stated for consumer agents. Most consumer pages describe what is saved (browser cookies, session history) and how to delete it, but not how long it is kept; the developer tools keep screenshots in the customer's own environment.
- Products are being renamed and retired. OpenAI's Operator preview was folded into ChatGPT agent in 2025, ChatGPT Atlas was scheduled to stop working on 9 August 2026, and Google's help page says Gemini Tasks was previously called Spark.
What are computer-use and browser agents?
A computer-use agent controls a graphical interface: it takes a screenshot, a model decides the next action, and the agent moves a virtual mouse or types. A browser agent does the same inside a web browser, sometimes with access to the page structure as well as pixels. Both differ from API agents, which call structured interfaces with scoped credentials. The trade-offs between the two styles are covered in Computer-Use Agents vs API-Integrated Agents; this page is the product reference.
The products fall into two groups:
- Consumer and workplace agents: finished products inside an app or browser, used by a person with their own accounts and sessions.
- Developer tools: APIs, tools and hosted browsers that developers wire into their own agent loop, where the developer controls the environment, credentials and approvals.
Always-on personal assistants that run across chat channels, such as OpenClaw, are covered separately in Personal AI Agents.
Consumer and workplace agents at a glance
As of 2026-11-15. Listed alphabetically by product name. Source: each provider's help, support or launch page, listed in the sources section.
| Product | Provider | Status | Plans | Platforms |
|---|---|---|---|---|
| ChatGPT agent | OpenAI | Launched 17 July 2025 | At launch: Pro, Plus and Team, then Enterprise and Education; Pro 400 messages a month, other paid plans 40, with credit-based options for more | ChatGPT; EEA and Switzerland access was still being worked on at launch |
| Claude computer use (Cowork) | Anthropic | Beta | Pro, Max and Ultra; Team and Enterprise do not currently have access | Claude Desktop on macOS and Windows; background windows need macOS 15 or later |
| Claude in Chrome | Anthropic | Available on paid plans | Pro, Max, Ultra, Team and Enterprise (Enterprise needs admin enablement) | Google Chrome only; not other Chromium browsers or mobile |
| Comet | Perplexity | Available | Not stated by Perplexity on the page checked | Mac, Windows, iOS and Android |
| Gemini Tasks | Available | Google AI Pro or Ultra; personal Google Accounts, age 18 or over | Gemini mobile app, Mac app and web; Chrome auto browse on desktop only; not available in the EEA, Nigeria, Switzerland or the UK |
What each consumer agent can do
- ChatGPT agent (OpenAI): combines a visual browser, a text-based browser, a terminal, direct API access and ChatGPT connectors such as Gmail and GitHub. Deep research is part of ChatGPT agent.
- Claude computer use in Cowork (Anthropic): operates permitted desktop applications by taking screenshots of the screen, from the Claude Desktop app.
- Claude in Chrome (Anthropic): a side panel that reads, clicks, types, navigates and fills forms on the current page, works across a tab group, runs scheduled tasks and background workflows, and can be controlled from Claude Desktop and Claude Code, which can read console logs, network requests and page state.
- Comet (Perplexity): a browser with an assistant that Perplexity describes as acting as a personal assistant, with example tasks covering research, building a basic website, drafting email, study plans and shopping.
- Gemini Tasks (Google): summarises or archives newsletters, unsubscribes from lists, monitors flight and hotel prices, researches with cited sources and produces files, browses sites for shopping and bookings, and works with Gmail, Calendar, Docs, Drive and Sheets; up to 15 tasks can run at once.
Developer tools at a glance
As of 2026-11-15. Listed alphabetically by provider. These tools run in an environment the developer or customer controls.
| Provider | Tool | Status | Environment | Pricing basis |
|---|---|---|---|---|
| Amazon Web Services | Amazon Bedrock AgentCore Browser | Not stated on the page checked | AWS-hosted, containerised browser; managed (aws.browser.v1) or custom browsers; sessions default to 15 minutes, up to 8 hours | AgentCore consumption pricing |
| Anthropic | Claude computer use tool | computer_toolset_20260801 out of beta on the Claude API since 19 August 2026; earlier versions remain beta | Developer-run VM or container; Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry | Standard tool-use token pricing; about 4,500 input tokens of toolset overhead and roughly 1,000 to 1,800 tokens per screenshot |
| Gemini API Computer Use | Not labelled preview on the page checked | Developer-run browser, mobile or desktop environment | Gemini API token pricing | |
| Microsoft | Copilot Studio computer use | Per model: CUA, GPT-6 Sol and Claude Sonnet 4.5 generally available; Claude Sonnet 4.6 and Opus 4.6 experimental | A Windows machine the customer sets up, selected in the tool's Machine setting | 5 Copilot Credits per step, or 15 with a premium model |
| OpenAI | Computer use (Responses API) and Agents API computer use | Not stated on the guide page; Agents API computer use added 29 September 2026 | Developer-run browser or desktop; the Agents API option uses an OpenAI-hosted browser | API token pricing |
How each developer tool works
- Amazon Bedrock AgentCore Browser: agents drive the browser through a WebSocket automation endpoint, and a Live View endpoint lets a person watch and interact in real time. Custom browsers add session recording (DOM changes, actions, console logs and network events stored in your Amazon S3 bucket), custom network settings and a specific IAM execution role. Sessions are isolated and ephemeral. AWS names Strands, Nova Act and Playwright as libraries that simplify interaction.
- Claude computer use tool: a client-side toolset with 17 member tools for screenshots, mouse and keyboard, used through the Messages API; it is not available in Claude Managed Agents. Anthropic also offers a separate browser use toolset (browser_toolset_20260801) for tasks that stay within web pages. The computer use tool page states that Claude Opus 5.5 on the Claude API does not accept the earlier computer_20251124 tool, while on Amazon Bedrock Claude Fable 5.2, Mythos 5.2, Opus 5.5, Sonnet 5.5 and Haiku 5.5 still accept it.
- Gemini API Computer Use: the model returns actions such as click, type, scroll, navigate and take_screenshot, which the client executes. Each action may carry a safety_decision; when it is require_confirmation the client must ask the user and return a safety_acknowledgement, and a blocked decision means the client should stop.
- Copilot Studio computer use: lets an agent with generative orchestration operate websites and Windows desktop apps through a virtual mouse and keyboard, powered by Computer-Using Agent models. Access control can restrict interaction to an allowlist of URLs and apps, and an Enforce HTTPS setting limits interaction to https sites.
- OpenAI computer use: the computer tool remains supported in the Responses API, and OpenAI's guide now presents code execution with strict function tools (exec_js or exec_py) as an alternative path. The application runs the tool loop and returns results, including screenshots, to the model.
Permission and confirmation controls
As of 2026-11-15. What each provider documents about approvals, confirmations and refusals. Wording is the provider's, summarised.
| Product or tool | Approval modes or settings | Always asks or pauses before | Refused or blocked |
|---|---|---|---|
| Amazon Bedrock AgentCore Browser | Live View lets a person watch and take part in a session | Set by the developer's agent | Set by the developer's agent and network settings |
| ChatGPT agent | Users can interrupt, take over the browser, pause or stop; Watch Mode for some critical tasks | Real-world actions such as purchases; sending email under Watch Mode | High-risk tasks such as bank transfers |
| Claude computer use (Cowork) | Approval for each application; full-screen permission asked once per session on macOS; user blocklist | Interacting with each new application | Investment, trading and cryptocurrency apps blocked by default; blocklisted apps denied |
| Claude computer use tool | Developer-defined; Anthropic recommends human confirmation of consequential actions | Classifiers scan screenshots and steer the model to verify suspected injected instructions with the user | Set by the developer |
| Claude in Chrome | Manually approve, Automatically approve (default in the Cowork side panel) or Skip all approvals; admin site allowlists and blocklists | Changing permissions, granting authorisations, entering sensitive information, irreversible deletions | Purchases, account creation, card or ID data, untrusted downloads, trades, modifying system files, following instructions found in web content |
| Comet | Not stated by Perplexity on the page checked | Not stated by Perplexity on the page checked | Not stated by Perplexity on the page checked |
| Copilot Studio computer use | Maker-provided or end-user credentials; URL and app allowlist; Enforce HTTPS | Suspected harmful instructions are emailed to a designated reviewer, and the run expires if no one responds in time | Interaction outside the allowlist (navigation is still possible) |
| Gemini API Computer Use | safety_decision on each action; disabled_safety_policies expresses a preference only | Actions marked require_confirmation, with policy categories including financial transactions, account creation and legal terms | Actions with a blocked decision |
| Gemini Tasks | Asks before each browsing task after Chrome auto browse is connected | Sending communications, modifying or deleting data, purchases, financial transactions, submitting forms, Sign in with Google (even with "Always allow"); pauses before sharing health, financial or ID details | Not stated as a list |
| OpenAI computer use (API) | Developer-defined approval callback | Pending API safety checks stop the sample loop until handled | Set by the developer |
Two settings deserve attention in workplace rollouts. In Copilot Studio, Microsoft warns that with maker-provided credentials anyone using a shared agent can act with the author's access on the configured machine. In Claude in Chrome, the default Automatically approve mode lets Claude work continuously and pause when needed, so administrators should decide whether that default fits their risk appetite and use site allowlists.
Data handling
As of 2026-11-15. "Not stated" means the provider did not publish the fact on the pages checked.
| Product or tool | What is stored | Retention period | User or admin controls |
|---|---|---|---|
| Amazon Bedrock AgentCore Browser | Session recordings in the customer's S3 bucket (custom browsers); sessions reset after use | Set by the customer's S3 configuration | CloudTrail logging, CloudWatch metrics, session TTL |
| ChatGPT agent | Browsing cookies persist under each site's cookie policy | Not stated by OpenAI | One setting deletes all browsing data and logs out of all sites; data typed in takeover mode is not collected or stored |
| Claude computer use (Cowork) | Screenshots of permitted apps are taken to navigate | Not stated by Anthropic | Per-app approval; memory can be viewed, edited or deleted |
| Claude computer use tool | Screenshots, actions and files stay in the customer's environment; requests processed in real time | Per Anthropic's API data retention policy; ZDR eligible (excluding Covered Models) and HIPAA eligible | Developer controls the environment |
| Claude in Chrome | Side panel sessions saved to Cowork history and synced across the account | Not stated by Anthropic | Admin enablement, site allowlists and blocklists |
| Comet | Not stated by Perplexity on the page checked | Not stated by Perplexity | Not stated by Perplexity on the page checked |
| Copilot Studio computer use | Stored sign-in credentials in Power Platform internal storage or Azure Key Vault; reasoning and screenshots shown in chat | Not stated by Microsoft | Choice of credential store, allowlist, dedicated machines |
| Gemini API Computer Use | Client-side environment run by the developer | Not stated on the page checked | Developer controls the environment |
| Gemini Tasks | Remote browser cookies and sign-in data saved between sessions; files on the remote computer | Not stated by Google; Gemini may delete remote browser data automatically | Delete browser data in Settings; turning off task mode deletes remote browser and code execution data; Keep Activity must be on |
| OpenAI computer use (API) | Client-side environment; examples set store to false | OpenAI notes that store false does not remove every form of retention | OpenAI data controls |
Google also warns that with a local browser Gemini can reach every site the user is signed into in Chrome and may share name, contact details, files and preferences with third parties to complete tasks, and advises against typing passwords or payment details into the task thread. OpenAI's Atlas help article similarly advises treating exported cookie and session files as sensitive.
Retired and renamed products
| Product | Provider | What changed | Date |
|---|---|---|---|
| ChatGPT Atlas | OpenAI | Scheduled to stop working; browser-based agent work moved to the ChatGPT desktop app and the ChatGPT Chrome extension or sidebar. Bookmarks, tabs and history did not transfer automatically. | 9 August 2026 |
| Gemini Tasks | Google's help page states the feature was previously called Spark | Not stated | |
| Operator | OpenAI | Research preview to be sunset a few weeks after ChatGPT agent launched | Announced 17 July 2025 |
Security risks and where to go deeper
The provider documentation agrees on the main risk and the main mitigations. Anthropic states that instructions on web pages or in images can override the user's instructions; Google tells developers to sandbox the agent and always handle safety decisions; Microsoft recommends dedicated, isolated machines with least-privilege accounts and allowlisted sites; OpenAI recommends a fresh browser profile or isolated desktop, limited network access and credentials kept out of page text and screenshots.
- Indirect prompt injection: hostile content on a page steers the agent. See MITRE ATT&CK T1698 Indirect Prompt Injection.
- Session and credential exposure: a browser agent inherits the user's signed-in sessions, and a workplace agent may run under a maker's credentials. See the Browser and Computer-Use Agent Guide and the Agentic Browsers Security Guide.
- Excessive agency: broad approval modes and wide app access let one mistake travel far. See the OWASP LLM Top 10 LLM06 Excessive Agency Guide.
- Containment: isolated VMs, containers and egress allowlists limit the blast radius. See Agent Sandboxing vs Tool Allowlisting and the Agent Egress Control and Network Isolation Guide.
- Copilot Studio specifics: see the Securing Microsoft Copilot Studio Agents Guide.
How to choose a computer-use or browser agent: factual criteria
These are criteria, not recommendations. Match them to your use case and policy.
| Criterion | Question to answer | Where the answer is documented |
|---|---|---|
| Who acts | Will the agent act as an individual user, or as a service you build and operate? | Consumer versus developer tables above |
| Plan and region | Is the product available on your plan and in your country? | Provider help pages; Gemini Tasks and ChatGPT agent list regional limits |
| Admin control | Can administrators enable, disable and restrict sites or apps centrally? | Permission table |
| Approval model | Which actions always need confirmation, and can users weaken the default? | Permission table |
| Credentials | Whose sessions or credentials does the agent use, and where are stored secrets kept? | Permission and data handling tables |
| Environment | Does it run on the user's own machine, a hosted browser or an isolated VM you control? | Developer tools table |
| Data and audit | What is stored, for how long, and what logs or recordings exist? | Data handling table |
| Cost | Is it a subscription, per step, or per token with screenshot overhead? | Plan and pricing columns |
A small organisation will often meet these agents first through staff subscriptions, so the priority is a written policy and the admin controls of the plans in use. A larger organisation building its own agents should standardise on an isolated runtime with recording and allowlisted egress, and treat every credential the agent uses as a non-human identity with an owner and a review date.
Practitioner checklist
- Inventory which computer-use and browser agents staff can reach on your current plans, and decide which are allowed.
- Set organisation-level controls where offered: enablement, site or app allowlists and blocklists, and approval defaults.
- Run developer agents in a dedicated VM, container or hosted isolated browser with an egress allowlist.
- Never give an agent a maker's or administrator's personal credentials; use dedicated, least-privilege accounts and a secrets store.
- Require human confirmation for payments, sending messages, deletions and accepting terms, and handle every safety or confirmation signal the API returns.
- Turn on session recording or logging where available and keep it with your audit evidence.
- Budget for screenshot token overhead or per-step credits when estimating cost.
- Review provider help pages monthly for renamed, retired and newly restricted products.
Standards and references
- Amazon Web Services: AgentCore Browser developer guide (accessed 2026-11-15)
- Anthropic: Computer use tool (accessed 2026-11-15)
- Anthropic: Claude Platform release notes (accessed 2026-11-15)
- Anthropic: Getting started with Claude in Chrome (accessed 2026-11-15)
- Anthropic: Claude in Chrome permissions (accessed 2026-11-15)
- Anthropic: Let Claude use your computer in Cowork (accessed 2026-11-15)
- Google: Gemini API Computer Use (accessed 2026-11-15)
- Google: Tasks in Gemini Apps help (accessed 2026-11-15)
- Microsoft Learn: Computer use in Copilot Studio (accessed 2026-11-15)
- OpenAI: Introducing ChatGPT agent (accessed 2026-11-15)
- OpenAI: Evolving Atlas into ChatGPT for browser-based agentic work (accessed 2026-11-15)
- OpenAI: Computer use guide (accessed 2026-11-15)
- OpenAI: API changelog (accessed 2026-11-15)
- Perplexity: Comet (accessed 2026-11-15)
Related NHI Mgmt Group resources: Personal AI Agents, Computer-Use Agents vs API-Integrated Agents, Browser and Computer-Use Agent Guide, Frontier AI Models Compared.