Computer-use agents close in on the human baseline on OSWorld-Verified

On February 5, both OpenAI and Anthropic released new flagship models for agentic work: GPT-5.3-Codex and Claude Opus 4.6. Most of the coverage focused on coding. The more consequential number for business automation is a different one: how well a model can operate a computer the way a person does, by looking at the screen, moving a pointer and typing.

What OSWorld measures

OSWorld is an academic benchmark of 369 computer tasks that involve real web and desktop applications, file operations and workflows spanning multiple apps, run in Ubuntu, Windows and macOS environments. When the paper was published, humans completed about 72.36% of the tasks and the best model reached 12.24% ^[2]. A "Verified" version of the benchmark followed; OpenAI describes it as one where models use vision to complete tasks in a desktop environment ^[1].

That makes it a reasonable proxy for what a browser or desktop agent does for a business: fill a multi-step form, move data between a spreadsheet and a web app, change a setting in a tool that has no API.

The numbers this week

OpenAI's GPT-5.3-Codex results, as reproduced by Laravel News (we could not open OpenAI's own page), show 64.7% on OSWorld-Verified. The previous Codex model scored 38.2% and GPT-5.2 scored 37.9%. OpenAI ran the evaluations at its highest reasoning setting, and lists a human baseline of around 72% on the benchmark ^[1].

That is a jump of 26.5 percentage points in one model generation, leaving the model roughly 7 points below the human reference. These are vendor-reported results, not independent measurements.

For context on the trend, Anthropic reported 61.4% on OSWorld for Claude Sonnet 4.5 in September 2025, up from 42.2% for Sonnet 4 about four months earlier, and shipped a Claude for Chrome extension that browses sites and fills spreadsheets ^[3]. Anthropic's Opus 4.6 announcement says the model is "industry-leading... often by a wide margin" across agentic coding, computer use, tool use, search and finance, but its text includes no OSWorld figure; the comparison table is an image ^[4]. We therefore do not compare the two vendors' latest models directly.

A caution on the table above: OSWorld and OSWorld-Verified are different versions of the test, and vendors configure them differently. Use the figures to read each vendor's trajectory, not to rank vendors.

What the benchmark does not tell you

It is a sandbox. Tasks run in clean, isolated environments. Your accounting system has years of customization, pop-ups and an expired-session login page. Success on a benchmark does not transfer one-for-one.

It scores completion, not cost or speed. A computer-use agent works from screenshots, step by step. That is slower and more expensive per task than calling an API. If a system has an API, the API is still usually the better integration.

It does not score safety. The same week showed the downside. Researchers at Koi Security audited 2,857 skills on ClawHub, the marketplace for the open-source OpenClaw assistant, and flagged 341 as malicious; 335 of them were tied to one coordinated operation that used fake setup steps to install an information stealer ^[5]. Separately, a flaw tracked as CVE-2026-25253 (CVSS 8.8) allowed a crafted link to leak an OpenClaw gateway token and, in the researchers' chain, switch off command-approval prompts. The maintainer said it was exploitable even when the gateway listened only on loopback, and it was fixed in version 2026.1.29 ^[6]. Palo Alto Networks, quoted in the coverage, described this kind of agent as a "lethal trifecta" of access to private data, exposure to untrusted content and external communication ^[5].

Where this leaves buyers

Computer-use agents are moving from demonstration to a tool with measurable, improving reliability. The sensible adoption path is narrow and boring: pick a repetitive workflow with no API, run the agent in an isolated environment with its own low-privilege account, keep a human approving consequential steps, and measure completion on your own tasks rather than on a vendor benchmark.

For businesses: pilot a computer-use agent on one internal, low-risk workflow before granting it production credentials, and treat any third-party add-on the agent can install as untrusted software.