Computer-Use Agents: Routing Microsoft, Anthropic, and Google

Three major computer-use agent platforms now compete in the same category: Microsoft Copilot Studio reached general availability on May 13, 2026; Anthropic Claude Computer Use has been in public beta since October 2024; and Google Gemini 2.5 Computer Use shipped as a developer preview in October 2025. All three pass the OSWorld benchmark's human baseline of approximately 72%, but they differ sharply in architecture, sandbox model, pricing unit, and enterprise-fit. This is the routing guide — not a horse race.

The benchmark convergence is real but misleading as a selection signal. Claude Opus 4.7 scores 78.0% OSWorld-Verified; Gemini 3.5 Flash reportedly scores 78.4% — though that model does not expose a Computer Use API as of May 24, 2026. GPT-5.5 reportedly scores 78.7% (vendor self-reported). All three sit within 0.7 points of each other, above the ~72.36% human baseline. At that resolution, benchmark differentiation is noise. The real question is architecture fit: what does your agent need to access, how is it deployed, what does it cost per step, and who governs its actions?

This guide covers the current status of each stack, an honest OSWorld calibration, a proprietary 3-way decision matrix, sandbox architecture differences, per-task cost modeling, a concrete routing guide, security and governance primitives, and a projection of where the three stacks converge over the next 12 months. For the Microsoft-specific deep dive, see Copilot Studio Computer-Use Agents: GA Deep Dive. For enterprise governance and guardrails, see Agent Computer Use: Enterprise Automation Playbook.

The three readiness labels carry operational weight. GA means Microsoft has committed to SLAs, billing, and enterprise support contracts for Copilot Studio computer use — teams can build production workflows against it today across all commercial Power Platform geographies. Beta means Anthropic's Computer Use API is stable enough for production use but may change; the beta header requirement (computer-use-2025-11-24for Opus 4.7, Opus 4.6, Sonnet 4.6, and Opus 4.5) is the flag that the interface is not yet frozen. Preview means Google's Gemini 2.5 Computer Use is a developer-facing model card release — it can be used, but it carries no GA commitment and the API surface may change without notice.

Microsoft's GA announcement on May 13, 2026 was broader than a technical flag — it included a customer case study from Graebel, a 1,500-employee mobility firm that deployed a Service Order Agent to process free-form relocation request emails into its proprietary "Global Connect" platform across more than 30 relocation service categories. Matt Brownlee, Chief Revenue Officer of Graebel, stated: "By adopting Microsoft Copilot Studio and AI agents, we've moved beyond traditional automation to a more intelligent, scalable operating model." This is a meaningful signal — GA is production-ready, not just feature-complete.

Anthropic's Computer Use was first announced October 22, 2024 with Claude 3.5 Sonnet, scoring just 14.9% on OSWorld at screenshot-only mode. That figure is 16 months old and has since been superseded by the OSWorld-Verified methodology. The beta label has persisted through six model generations because Anthropic is still refining the tool interface, not because the capability is unstable. The Claude Computer Use API docs are detailed and production-grade. Our Anthropic Computer Use API guide covers the full surface in depth.

Google's Gemini 2.5 Computer Use preview launched October 7, 2025 and is available via the Gemini API on Google AI Studio and Vertex AI. The model identifier is gemini-2.5-computer-use-preview-10-2025. One critical clarification: Gemini 3.5 Flash, which launched at Google I/O 2026 on May 19, 2026 and reportedly scores 78.4% OSWorld-Verified, does not expose the Computer Use API as of May 24, 2026. Teams evaluating Google's computer-use stack must use the 2.5 preview model, not 3.5 Flash. For the 3.5 Flash context, see our Gemini 3.5 Flash benchmarks guide.

OSWorld is the most credible independent benchmark for computer-use agents — 369 actual desktop tasks across real operating systems, real apps, and real workflows. But it is being misread in three consistent ways across engineering blogs and vendor comparisons. Understanding the traps is essential before using the scores as a selection input.

Trap 1: OSWorld vs OSWorld-Verified are not the same scale. Anthropic introduced OSWorld-Verified in July 2025 — a re-evaluation methodology that corrects for task ambiguity and partial-credit scoring in the original OSWorld. Scores from Sonnet 4.5 onward (61.4%) use OSWorld-Verified; scores from Sonnet 3.5 (14.9%) through Sonnet 3.6 (42.2%) use original OSWorld. Mixed-scale comparisons inflate the apparent slope. The trajectory within each scale is valid; cross-scale comparisons are not. As noted in Coasty's independent benchmark commentary, "An agent scoring 38% or even 61% isn't ready to handle the unpredictable, multi-step, context-heavy work that fills a real knowledge worker's day."

Trap 2: Gemini 3.5 Flash's 78.4% does not mean a usable Computer Use API. Gemini 3.5 Flash, launched at Google I/O 2026 on May 19, reportedly scores 78.4% OSWorld-Verified per llm-stats.com analysis. This figure refers to the model's reasoning and vision capabilities, not a deployed Computer Use API surface. As of May 24, 2026, Gemini 3.5 Flash does not expose the computer-use-preview tooling. Only the gemini-2.5-computer-use-preview-10-2025 model does. A team that reads "78.4%" and builds against Gemini 3.5 Flash will find no Computer Use API.

Trap 3: above-human convergence means benchmark differentiation has diminishing return. Claude Opus 4.7 scores 78.0% OSWorld-Verified; GPT-5.5 scores 78.7% (vendor self-reported); Gemini 3.5 Flash reportedly scores 78.4%. The three-way spread is 0.7 points — less than the measurement error in the benchmark. At this level, architecture fit, pricing model, and governance primitives dominate the selection decision far more than the benchmark delta. Our earlier three-way matrix comparing Claude, OpenAI, and Gemini covered the pre-Microsoft-GA landscape; this post updates that analysis with the May 13 Microsoft GA and the OSWorld-Verified recalibration.

No published comparison maps all three stacks against the same dimensions — particularly cost-per-task and sandbox architecture, which are the two most consequential variables for production deployments. The matrix below draws on Microsoft Learn (Computer Use, updated May 21, 2026), Claude API docs (Computer use tool), and Google DeepMind Gemini 2.5 Computer Use Model Card. For deeper detail on the Microsoft stack, see our Copilot Studio GA deep dive.

Every mainstream comparison of computer-use agents focuses on OSWorld scores and pricing. Almost none discusses sandbox architecture in detail — which is the variable that actually governs your data perimeter, security posture, and operational complexity.

Anthropic's architecture: Docker container you operate. Anthropic ships a reference Docker container with Xvfb (virtual X11 display), Mutter window manager, Tint2 panel, and pre-installed Linux apps including Firefox and LibreOffice. The agent loop runs in your infrastructure. Claude itself does not connect directly to the execution environment — it sends tool calls (screenshot, click, type, key, cursor_position) and your agent loop executes them inside the container. This architecture gives the most flexibility (you can install any Linux software, mount any filesystem, configure network isolation at the container level) and puts the most operational burden on you. Our Claude Computer Use production deployment guide covers the container configuration, token management, and rollback patterns in detail.

Microsoft's architecture: Power Automate–registered Windows machine. Copilot Studio computer use executes against a Windows machine registered in Power Automate's "machines" pool. Per-credential authentication via Power Platform internal storage or Azure Key Vault. Access control via per-website and per-app allowlists configured at the agent level. Human supervision via an Outlook email reviewer for low-confidence steps. This is the most prescriptive architecture — you cannot run a Linux container, cannot mount arbitrary filesystems, and cannot target macOS. But you also get Purview-based audit logs that propagate run history to Purview and Dataverse, DLP policies enforced at the environment level, and Power Platform RBAC — governance that would take months to build from scratch on Anthropic's stack.

Google's architecture: browser-only, no container. Gemini 2.5 Computer Use runs on browser surfaces — it can navigate, click, fill forms, and interact with web content. It does not provide a sandbox container at all. Google's earlier consumer-facing surfaces (Project Mariner, Firebase Testing Agent, AI Mode in Search) were the precursors to the developer API. For browser-automation use cases, this is appropriate. For desktop app automation — SAP GUI, Salesforce Classic, legacy Windows apps — it is not the right tool. See our Gemini 2.5 Computer Use for marketing automation guide for the browser use-case patterns in depth.

List prices are the wrong way to compare these three stacks. The right frame is per-task economics — what does a concrete workflow cost on each platform? The answer changes dramatically based on the number of steps and the number of screenshots per step, because the three pricing models scale differently.

Microsoft's Credit billing is step-count-based: 5 Credits per step on standard models (OpenAI CUA, Claude Sonnet 4.5/4.6), 15 Credits per step on premium models (Claude Opus 4.6 experimental). At $0.01 per Credit pay-as-you-go, that is $0.05 per step (standard) or $0.15 per step (premium). A 10-step web form workflow costs $0.50 on standard or $1.50 on premium. A 50-step research-and-summarize task costs $2.50 on standard or $7.50 on premium. The capacity pack (25,000 Credits for $200/month) reduces per-Credit cost to $0.008 — so a 10-step task at standard tier becomes $0.40. Microsoft's pricing is predictable and RPA-style: it scales with step count, not with how verbose the model is.

Anthropic's per-token pricing means cost scales with screenshot volume and context length. Each screenshot taken by the agent consumes vision tokens; each tool call adds 466–499 tokens of system prompt overhead plus 735 tokens per tool definition. A simple 10-step browser task at Sonnet 4.6 ($3/$15 per Mtok) with modest screenshots might cost $0.10–0.30. A 50-step legacy-desktop task with frequent screenshots and a large system prompt could reach $2.00–5.00 per run at Opus 4.7 ($5/$25 per Mtok). Token billing rewards short workflows and penalizes verbose, screenshot-heavy ones.

Google's Gemini 2.5 Computer Use charges $1.25/$10 per Mtok (input/output), the lowest token price of the three. For browser-automation workflows where the agent makes fewer tool calls and takes smaller screenshots than a full desktop agent, Gemini 2.5 CU can be meaningfully cheaper than Anthropic at equivalent task complexity. The 131K context window and 64K max output also reduce truncation risks on long-horizon workflows. The constraint is browser-only execution — you cannot use this model for desktop automation regardless of the price.

The break-even point:for a 20-step workflow, Microsoft standard ($1.00) competes with Anthropic Sonnet 4.6 at roughly 330K total tokens (input+output combined), which a screenshot-heavy task will exceed. For screenshot-light API-based tasks, Anthropic's per-token billing can undercut Microsoft. Run your own step-count and screenshot estimates against these figures before committing to a pricing model — the economics flip more often than vendor comparisons acknowledge.

The routing guide below maps the three stacks to the most common enterprise use cases. It is opinionated by design — every team that says "we need to evaluate all three" is burning engineering hours that a routing framework can recover.

One important nuance for the Microsoft routing: Copilot Studio computer use embeds both OpenAI CUA and Anthropic Claude models under the hood. Teams that "standardize on Microsoft" are implicitly consuming Anthropic capacity — Claude Sonnet 4.5, Sonnet 4.6, and Opus 4.6 are all available in the Copilot Studio model menu. This two-sided dependency is not widely noted in enterprise architecture discussions. The practical implication: if your organization has Anthropic API agreements or data processing addendums, those obligations may extend to your Copilot Studio usage when Anthropic models are selected.

For teams already evaluating the broader OpenAI computer-use lineage, our guide to OpenAI's GPT-5.4 computer-use tool covers the model that Microsoft licenses for its CUA option in Copilot Studio, including the lineage from ChatGPT Operator (sunset Aug 31, 2025) to the current CUA API.

Computer-use agents operate in a uniquely risky attack surface. Prompt injection via on-screen content — a malicious website embedding instructions in visible text that the agent reads via screenshot — is the most common attack vector. Each stack addresses it differently.

Anthropic:Claude's computer-use API includes prompt-injection classifiers that automatically scan screenshots for embedded injection attempts. On detection, the model steers to ask for user confirmation rather than executing the embedded instruction. This is a model-level defense — it operates before the tool call executes. You still need to implement sandbox isolation (network egress controls, credential management, filesystem scope limits) at the container level. The Claude API docs provide a detailed risk section covering injection mitigations, credential handling, and the recommendation to always run in a sandboxed environment with limited system permissions.

Microsoft: Copilot Studio provides governance at the platform level — per-environment DLP policies that can block specific website categories, per-agent allowlists for which websites and desktop apps the agent may interact with, Azure Key Vault for credential storage (so no credentials live in the agent prompt), and Purview audit logs for every run. Human-in-the-loop is implemented via Outlook email review — a low-friction, enterprise- native checkpoint for low-confidence steps. This is the most complete out-of-the-box governance story of the three stacks.

Google: Gemini 2.5 Computer Use provides no built-in governance layer. The browser-only scope is itself a constraint that limits the blast radius — a browser agent that goes rogue cannot interact with native desktop applications. But there is no DLP layer, no audit log, no credential vault, and no human-in-the-loop primitive provided by Google. For enterprise deployments, the security stack is entirely your responsibility.

For a detailed guardrail checklist covering all three stacks — including human-in-the-loop patterns, screenshot logging, and rollback procedures — see the Agent Computer Use: Enterprise Automation Playbook. That playbook is the companion to this post and covers the operational depth that this routing guide does not.

The OSWorld trajectory from October 2024 to May 2026 is the most dramatic benchmark improvement in enterprise AI tooling since GPT-4 crossed the bar exam in 2023. Claude Computer Use went from 14.9% (Sonnet 3.5, Oct 2024) to 28.0% (Sonnet 3.5 v2) to 42.2% (Sonnet 3.6) to 61.4% (Sonnet 4.5) to 72.5% (Sonnet 4.6, Feb 2026) to 78.0% (Opus 4.7, Apr 2026). That is sub-15% to above-human-baseline in 16 months. The slope is the story, not any individual data point.

What the slope implies is that the benchmark ceiling will be hit before the market ceiling. If Opus 4.7 and Gemini 3.5 Flash are both already at 78%, and GPT-5.5 is at 78.7%, the next meaningful innovation is not a higher OSWorld score — it is depth of integration with enterprise systems, reliability on multi-hour tasks, and cost reduction at scale. The vendor that wins the enterprise computer-use category over the next 12 months will do so on governance, integrations, and pricing, not on benchmark scores. That framing strongly favors Microsoft in regulated industries (governance is already built) and Anthropic in technical teams (the Docker architecture gives the most integration flexibility).

For Google, the key inflection point is whether Gemini 3.5 Flash or a successor model exposes a Computer Use API. If Google ships a 78.4%-class model with a Computer Use API surface — combining the best benchmark score of the three with the lowest token pricing — the routing calculus changes significantly. As of May 24, 2026, that model does not exist in the developer API. Watch for it in the next Gemini release cycle.

One structural pattern that will shape the next 12 months: the Copilot Studio model menu already includes Claude Sonnet 4.5 and Sonnet 4.6 alongside the OpenAI CUA option. As Anthropic ships stronger models, those models will likely appear in the Copilot Studio menu without requiring Microsoft to build any new capability. The Claude Opus 4.7 reference guide covers the model's full capability profile including why it sits at 78.0% OSWorld-Verified and what that score does and does not predict about production performance.

Our view: the benchmark convergence above human baseline is a threshold event, not a steady-state. The period from H2 2026 through H1 2027 will be characterized by reliability and governance improvements rather than raw benchmark gains — much like how LLM development shifted from perplexity improvements to RLHF and safety work in 2023. Teams that use this window to build the operational infrastructure (logging, HITL, credential management, rollback) will compound their advantage when the next model generation arrives. Our AI transformation services help enterprise teams build that infrastructure before it is table-stakes.