On this pageJump to a section
Two companies have now shipped an AI that can look at a screen and use it like a person. One of them launched yesterday.
That is exciting for anyone who has ever spent a Friday copying data between tabs. It is also the moment to decide, on purpose, what you will let it touch. As a solo operator, I want the upside of an agent as much as anybody. I also know what one wrong click inside an ad account or a bank login costs.
The question is not whether to use browser agents. It is what they may touch, and who signs off.
What can AI browser agents actually do right now?
They can use websites the way you do, by looking and clicking. That is the whole shift.
Operator, released January 23, 2025
OpenAI describes Operator as an agent that uses its own browser to look at a webpage and interact with it by typing, clicking and scrolling. It is a research preview, available to Pro users in the U.S. at launch, with plans to expand later.1 It is powered by a model called Computer-Using Agent, which combines GPT-4o's vision with reinforcement learning to work with buttons, menus and text fields.1
OpenAI says it can handle repetitive browser tasks such as filling out forms and ordering groceries, without needing custom API integrations.1
Claude's computer use, announced October 22, 2024
Anthropic's version arrived three months earlier as a public beta on its API (I covered it in Claude Computer Use). Developers can have Claude view a screen, move a cursor, click buttons and type text. Anthropic suggests uses like automating repetitive processes and open-ended research.2 On the OSWorld benchmark, the upgraded Claude 3.5 Sonnet scored 14.9% in the screenshot-only category and 22.0% when given more steps.2
Anthropic reports the next-best system scored 7.8% in the same category.2 That is a lead, and it is also a reminder that most of the road is still unbuilt.
OpenAI introduced Operator in a livestream posted on January 23, 2025. Sam Altman opened with a definition: "AI agents are AI systems that can do work for you independently you give them a task and they go off and do it."4 Take "go off and do it" as the pitch, and the confirmation step shown in the demo as the guardrail.
VideoOpenAI
Introduction to Operator & Agents
The 24-minute demo shows the confirmation step and the safety mitigations OpenAI describes.
What do the makers say it cannot do yet?
Read the fine print, because the vendors wrote it honestly.
At times cumbersome and error-prone.
Anthropic says computer use is experimental, that actions like scrolling, dragging and zooming still challenge it, and that developers should start with low-risk tasks.2 OpenAI says Operator "encounters challenges with complex interfaces like creating slideshows or managing calendars" and may make mistakes.1
Anthropic's separate guidance on agents is just as blunt: the autonomous nature of agents means higher costs and the potential for compounding errors, so it recommends extensive testing in sandboxed environments with the right guardrails.3 One bad click is a nuisance. Ten chained clicks built on the first bad one is an incident.
Which parts of your business should an AI agent be allowed to touch?
Use a permission ladder. Three rungs, and you climb one at a time.
| Rung | What the agent may do |
|---|---|
| Green: read and research | Browse public sites, collect information, compare options, summarize. Nothing it does changes anything. |
| Amber: draft with approval | Fill a form or write a reply, then stop. A human reviews and submits. |
| Red: human only | Logins, payments, banking, ad account settings, client messages, deleting anything. |
Why Red stays human, even if the agent can do it
Look at how Operator is designed. It asks the user to take over when inputting sensitive information such as login credentials or payment details. It should ask for approval before finalizing any significant action like submitting an order or sending an email. It is trained to decline some sensitive tasks, such as banking transactions. On sensitive sites like email or financial services it runs in a watch mode that requires close supervision.1
That is the builder telling you where it is nervous. Your rules should be at least that strict.
The hidden risk is the website
OpenAI also notes that adversarial websites may try to mislead the agent with hidden prompts, malicious code or phishing attempts, and says Operator is designed to detect and ignore prompt injections.1 Anthropic warns computer use may open a new route for spam, misinformation and fraud.2
If you run paid traffic, think about what that means. An agent that reads untrusted pages while logged into a place where money moves is a risk by design. Keep research agents and logged-in agents separate, with a human in the loop as I argued for voice agents.
What does the ladder look like in an ad-driven business?
Here is how I would sort a few real chores. These are my picks, not a standard.
- Green: pulling a competitor's public landing pages into a comparison table, checking a price page, gathering the dates and rules from a platform's public documentation.
- Amber: filling in a vendor's contact form, drafting a support ticket, preparing (but not sending) a reply to a customer inquiry.
- Red: changing an ad budget, editing a campaign, touching a payment method, replying to a client or buyer, anything inside a login that moves money or data.
The pattern is simple. The more irreversible and the more public the action, the higher the rung and the more human the approval. If undoing it takes more than a minute, a person does it.
How do you roll one out without losing a weekend to cleanup?
- Pick one boring task. Something repetitive, low-stakes and reversible, like collecting public information into a table.
- Keep it in Green. No logins. No submissions.
- Make it show its work. Require a list of what it visited and what it did, and read it.
- Move one task to Amber. Let it draft a form entry or reply, with a human submitting.
- Measure. Count the errors you caught. If you cannot count, you are not checking.
- Decide about Red later. If ever. The default answer is human.
Anthropic's advice for building agents applies to adopting them too, and it echoes my piece on agents versus workflows: find the simplest solution possible, and only increase complexity when needed.3 Most weeks, the simplest solution is a person with a checklist.
Should small operators care about this yet?
Yes, but as a student, not as a buyer. Neither product is a finished employee. Both are early versions of something that will get good fast, and the operators who win will be the ones who already have rules, logs and a habit of checking.
So write your ladder down this week, and if you want help setting one up, reach out. When the tools improve, you will decide what moves up a rung with evidence instead of excitement.
Keep building.Ekai
Questions people ask
What is OpenAI Operator?
Operator is a research preview of an agent that uses its own browser to perform tasks. OpenAI released it on January 23, 2025 to Pro users in the U.S. It looks at pages through screenshots and interacts by typing, clicking and scrolling.
What is Claude's computer use?
Computer use is a public beta capability, announced by Anthropic on October 22, 2024, that lets Claude look at a screen, move a cursor, click buttons and type text. Anthropic calls it experimental and at times cumbersome and error-prone.
Should an AI agent have access to my ad account or bank?
I would say no for now. Operator itself is built to hand control back to you for logins and payment details and to decline banking transactions, which tells you how its makers see the risk. Start with read-only and draft-only tasks.
How do I decide what a browser agent can touch?
Use a permission ladder: let it read and research freely, let it draft things you approve, and keep money, credentials, client messages and account settings with a human.
Sources
- 1
- 2
- 3
- 4
