Computer use crossed the demo-to-production line on narrow flows in early 2026 — the harness now matters more than the model, and six failure modes are the whole design job.
OSWorld sat at 15% completion in late 2024; by early 2026 it had climbed to 72.5% and WebArena's Claude Mythos Preview passed 68.7%. Those numbers don't say "browser agents ship" — they say "narrow flows now ship, and the harness that surrounds the model matters more than which model you picked." This chapter is the operational reality: which flows are in scope for a production computer-use agent in mid-2026, the six failure modes that don't show up in benchmarks (DOM drift, screenshot ambiguity, login-state expiry, modal interruptions, rate-limit cliffs, irreversibility), and the harness-level fixes for each. By the end you'll know when to reach for computer use, when to refuse and use an API, and what a production harness needs to survive a real corporate portal.
The 2024→2026 curve, honestly read.
The public benchmarks tell a real story if you read them carefully. OSWorld, the desktop-task benchmark that runs on Ubuntu/Windows/macOS VMs, sat around 15% completion at the end of 2024. By early 2026 the top of the leaderboard reached 72.5%. WebArena — a controlled web-task suite that's easier than OSWorld because it uses stable self-hosted apps rather than the live public web — saw the Claude Mythos Preview line hit 68.7%. Those are the numbers people cite when they say the corner has turned.
But the curve rewards a closer read. Median-task performance has climbed the hardest; the 90th-percentile task — the messy long-tail with anti-automation, dynamic layouts, and mid-run reauth — has moved less. WebArena is meaningfully easier than OSWorld because its DOMs don't drift between runs. Both are meaningfully easier than a real corporate portal, where session length is measured in hours, popups appear at unpredictable moments, and one bad click can charge a customer twice. And WebVoyager, which now sits above 98%, is best treated as saturated — it's a signal that the benchmark is done, not that browser agents are.
The honest reading: the model is no longer the bottleneck for narrow, well-shaped flows. What the median 2026 team is still figuring out is the harness — the code and prompts and recovery policies wrapped around the model — and how to shape a flow so the harness has any chance. The browser-agent-failure-modes deep-dive is the taxonomy this chapter builds on; the previous chapter, Computer Use, introduces the underlying loop.
Narrow flows that ship.
The 2026 production computer-use agent doesn't ship as "general web assistant." It ships as three shapes:
Form-filling with a known target. The agent lands on a specific page in a specific SaaS, fills specific fields from a specific record, and submits. Every meaningful variable — the URL, the field layout, the success criterion — is known before the run starts. This is the shape that internal ops teams put in production first: onboarding a new vendor into procurement, filing a repetitive compliance form, updating a customer record after a support call.
Contained SaaS flows with stable DOMs. A slightly bigger surface — three to eight steps within one SaaS app, where the app has released the same version to your tenant for months and each screen is one your eval set has seen. The browser-agents playbook collects the current best practice for this shape: pin the tenant, cache the login, and treat each screen as a mini-task the harness can retry independently.
Screenshot-driven QA of internal dashboards. The agent's job isn't to change state — it's to look at a dashboard, extract a handful of values, and report them back. Perception is the whole task; there are no clicks to miss. Reliability climbs into the high 90s because the failure surface is a single screen.
What doesn't ship in 2026: general-purpose "book me a flight," open-web research where the DOM changes between sessions, and anything involving irreversible money movement without a human confirmation gate. If your first proof-of-concept is one of those, you're on the wrong side of the curve — pick a narrow flow and get that one to 95% before you widen the scope.
The six failure modes benchmarks miss.
Benchmarks measure completion on prepared tasks. Production has failure modes that prepared tasks don't reproduce. The browser-agent-failure-modes deep-dive walks each in depth; here's the field-guide summary of what to watch for.
DOM drift between screenshots. The screenshot the model reasoned about is 400ms old by the time the click lands. A lazy-loaded card rerendered; a modal appeared; the "Save" button is now 40 pixels lower. The click hits nothing, or worse, hits the wrong thing.
Screenshot ambiguity. The target is off-canvas, or is one of three near-identical buttons in a dense grid, or is the one behind an overlay that's visually thin. The model picks confidently and picks wrong.
Login-state expiry. The session was valid at minute zero of the run and expired at minute nine. The next click drops onto a login form the model doesn't recognize and either types the task prompt into the username field or wanders.
Modal interruptions. A cookie banner, a "we've updated our terms" splash, a browser permission prompt, or the SaaS's own "quick tour" modal appears mid-run. Every subsequent click lands on the modal, not the app.
Rate-limit cliffs. Per-tenant caps are common on internal APIs and hidden on most SaaS UIs. The agent's tenth screenshot in a minute triggers a soft-block; the eleventh returns a captcha. Nothing in the harness knows the cliff is there.
Irreversibility. The agent clicks Delete. There is no Undo. The record is gone. This isn't a rare failure — it's a shape-of-task failure: any flow with a destructive action needs a harness that treats destructive clicks differently from safe ones.
Harness-level fixes.
The good news: each failure mode has a fix that lives in the harness, not the model. The disciplined 2026 team implements all six and treats them as non-optional infrastructure.
DOM-anchor hashing. Before each click, the harness hashes a small region around the target element and compares it to the hash from the screenshot the model reasoned about. If the hash has drifted, the click is refused and a fresh screenshot is taken. This alone catches most stale-screenshot misclicks.
# Harness anchor check before executing a click def safe_click(page, target, expected_anchor_hash): region = page.crop_around(target, radius=40) current_hash = perceptual_hash(region) if hamming(current_hash, expected_anchor_hash) > 6: return Refused("anchor drift", take_screenshot=True) page.click(target) return Executed()
Viewport auto-scroll before screenshot. If the target the model requested is off-canvas, the harness scrolls it into view before executing the click. The model can address elements it hasn't seen yet, and the harness carries the burden of making them visible.
Session-refresh checkpoint. Every N steps or every M minutes — whichever comes first — the harness pings a known "am I logged in?" endpoint and re-auths if not. Session expiry becomes a routine event the harness handles, not a mid-run confusion the model has to reason through.
Dismiss-modal-first policy. Before any click, the harness runs a small classifier over the screenshot for known modal shapes (cookie banners, browser prompts, SaaS tour overlays). If one is present, it's dismissed before the model's requested click ever fires.
Backoff with tenant awareness. The harness tracks requests-per-minute against a per-tenant budget and sleeps proactively. When a soft-block is detected (a captcha screen, a 429 in the network tab), it holds the run and alerts rather than mashing through.
Undoable-vs-irreversible action classification. Every action the model proposes is classified before execution: reversible (fill a field, navigate), reversible-with-cost (send an email), or irreversible (delete, purchase, submit payment). Irreversible actions route through a human confirmation gate, not the model's own judgment.
A recovered run looks like the trace below — the harness catches drift, dismisses the modal, and completes without the model ever noticing it wobbled.
step 04 screenshot#4 target=btn.save anchor_hash=a91c step 05 safe_click(btn.save) anchor_drift=8 REFUSED step 06 screenshot#5 modal_classifier=cookie_banner step 07 dismiss_modal(cookie_banner) OK step 08 screenshot#6 target=btn.save anchor_hash=a91c step 09 safe_click(btn.save) anchor_drift=1 EXECUTED step 10 session_check status=200 OK step 11 screenshot#7 toast="Saved" VERIFIED step 12 action_class(next=btn.delete) IRREVERSIBLE step 13 gate=human_confirm PENDING step 14 gate=human_confirm decision=approve EXECUTED step 15 done SUCCESS
When to refuse computer use.
Not every flow belongs to computer use. Three refusal criteria save more time than any harness fix.
An API exists at the same access tier. If the SaaS ships an API that your credentials can hit, use it. The API is faster, cheaper, and doesn't lose to modal interruptions. The computer-use-and-gui-agents playbook is explicit on this: GUI operation is a last resort, not a default. The only exception is when the API's rate limit or feature surface is worse than the UI's — rare, and worth confirming with the vendor before you commit.
The flow is high-stakes irreversible. Money movement, mass deletes, sending customer-visible communications at scale. Even with a confirmation gate, the failure mode where the model picks the wrong record to confirm is worse than the manual alternative. Route these through explicit human review from day one; if a computer-use agent belongs anywhere in that flow, it's as a data-gathering assistant, not the actor.
The target UI changes between sessions. Anti-automation, A/B tests exposed to your tenant, or a SaaS mid-migration between design systems. The harness fixes work when the DOM is stable enough that anchor hashes and modal classifiers stay meaningful. When the UI itself churns, the harness can't compensate and the eval set decays under you. Wait for the target to settle or negotiate with the vendor for a stable channel.
The through-line: 2026 production computer use isn't a bet on a model. It's a bet on a harness and a scope. Get both right and the median narrow flow ships. Get either wrong and the demo-to-production line moves right back where it was.