Giving an agent hands is the easy part

A team from a company called Cua gave a talk this week about what they call computer-use 2.0: agents that drive your actual machine, clicking and typing across Mac, Windows, and Linux, now running in the background so they do not seize your screen. The demo is the kind of thing that makes a room lean forward. They also reported a real gain, a focused driver that reads one window instead of the whole desktop pushed an agent’s pass rate from 62 to 80 percent while using 34 percent fewer tokens.

Then the same team said the honest part. Once you give an agent hands, the question stops being can it click and becomes can you trust it not to break something. So they built a benchmark for exactly that. On a set of electrical-engineering tasks scored by simulating the actual circuits, the best agent they tested fully passed six of 25. Every one of those six involved editing an existing schematic. Starting from a blank one, the success rate was zero. Across every model, nobody cleared 30 percent.

A computer-use agent, plainly, is a model that has been handed a mouse and a keyboard and told to go. That is a lot of authority. The vault’s security notes put the danger not in any single capability but in the combination: reach, permissions, and an environment full of things you did not mean to touch. Hands multiply all three at once.

Having said that, I do not read those humbling scores as a reason to wait. I read them as the reason the interesting work is the sandbox and the eval, not the hands. Anyone can wire up a click. Knowing, with a receipt, that the click did what you meant and nothing else is the whole job. Reach you can audit is capability. Reach you cannot is just a faster way to break something.