What a computer agent is, and the three things people mean by it

Three senses, labelled

The phrase collapses three unrelated things. People argue past each other because of it.

Sense 3 is older than the other two in common usage and has nothing to do with AI. If someone in infrastructure says "roll out the agent to the fleet," they mean a daemon with a config file. If someone in a product meeting says "we're building an agent," they mean Sense 1 or 2. Both are correct. Neither is the same conversation.

Where it came from

Russell and Norvig's definition — an agent perceives its environment through sensors and acts upon that environment through actuators — is deliberately broad enough to cover a thermostat. That was the point in 1995: the field needed one frame for robots, planners and software. It is also why the word is useless on its own. Everything is an agent under that definition, including a for loop.

Sense 2 is recent and narrow. Anthropic shipped the computer use tool in public beta on 22 October 2024, giving a model the ability to return screen coordinates and keystrokes instead of prose. OpenAI followed with the Computer-Using Agent behind Operator on 23 January 2025, initially limited to ChatGPT Pro subscribers in the United States at $200 per month. Between them, Anthropic announced the Model Context Protocol on 25 November 2024, which standardised the other half of the problem — connecting a model to tools and data without a bespoke integration per tool. OpenAI adopted MCP in March 2025 and Google DeepMind followed in April 2025, which is how a four-month-old specification became the default wiring.

So the plumbing arrived in a thirteen-week window. The word is thirty years old. That gap is most of the confusion.

What it is not: a workflow

The term people confuse it with is workflow automation. Anthropic's engineering writeup "Building effective agents," published in December 2024, draws the line cleanly: workflows are systems where models and tools are orchestrated through predefined code paths, while agents are systems where the model dynamically directs its own process and tool use.

A Playwright script that logs into a vendor portal, clicks three known selectors and downloads a CSV is not an agent. It is a script. It will do the same thing on every run and break the day the selector changes. A Zapier chain is not an agent. A UiPath robot following a recorded click path is not an agent either, even though the vendor category — robotic process automation, a label UiPath has traded under since it was founded in Bucharest in 2005 — sounds like one.

The difference is who decides step two.

It is also not a chatbot. A model that answers a question in one turn has no loop, no environment and no actions. And "AI SDR" is a market label, not an architecture — I wrote about what that term actually covers separately.

A worked example you can read the code for

Anthropic's computer-use-demo in the anthropic-quickstarts repository is the cleanest reference, because every part of the loop is visible.

It ships a Docker container with a Linux desktop, a browser and a VNC view, plus a Streamlit panel on port 8501 for watching the run. The cycle is three moves:

1. The harness takes a screenshot of the virtual display and sends it to the model as an image.
2. The model returns a tool_use block — an action and its arguments, for example {"action": "left_click", "coordinate": [412, 338]} or {"action": "type", "text": "invoice 4471"}.
3. The harness executes that action against the container's display with xdotool, takes a new screenshot, and sends it back.

Nothing in that loop knows what a login form is. The model sees pixels, guesses a coordinate, and finds out whether it was right on the next screenshot. That is the whole mechanism. A computer agent is a guess-and-check system with a camera, and the honesty of that framing matters.

Costs follow from it. Every step appends another image to the context, so step 30 of a run is more expensive than step 1 and the curve is not flat. Anthropic documents image token cost as roughly width × height ÷ 750, which puts a single 1024×768 screenshot near 1,050 tokens; thirty of them is more than 31,000 tokens of screenshots alone, re-sent on every subsequent turn. That property, not the per-token price, is what makes long runs expensive.

The test: does it actually qualify

Three questions. All three have to be yes.

Does the model choose the next action, or is the sequence in your code? If you can draw the full path in advance, you have a workflow. A workflow is the right answer most of the time. It is just not an agent.

Does it change course on what it observes? An agent that ignores the result of its last action is a script with extra latency.

Can it stop? Unbounded looping is the most commonly documented production failure for this class of system, and the fix is not a prompt. The stop condition — step cap, wall-clock budget, spend ceiling — has to be enforced outside the model, in the harness that holds the loop. That is the control layer, and it is the part most teams skip.

Then check the capability claim against published numbers. The three standard benchmarks are not interchangeable: OSWorld covers 369 real tasks across Ubuntu, Windows and macOS environments and was published in April 2024; WebArena, from Carnegie Mellon in 2023, holds 812 tasks on self-hosted clones of sites like GitLab and Reddit; WebVoyager, published January 2024, runs 643 tasks against 15 live public websites.

Browser tasks are close to usable. Full-desktop tasks are not — a 38.1% pass rate means roughly three in five tasks fail — and anyone telling you otherwise is selling.

Which is why I would not hand a computer-use agent credentials to anything that moves money or sends mail on a customer's behalf. Read-only first, narrow scope, one capped agent in production before the second one exists. A thing that cannot stop is not an agent. It is a loop with a bill attached.