GitHub Copilot CLI Computer Use Preview Targets GUI-Only Apps

What GitHub shipped

On October 1, GitHub put a computer-use capability into public preview for Copilot CLI and the standalone GitHub Copilot app on macOS and Windows.56 With it, Copilot can read accessible content and visual context in desktop applications, click controls, type and edit text, press keys, scroll, drag, and carry a workflow across several apps.1 GitHub says the feature is for legacy and GUI-only software that has no API, command-line interface or MCP integration.1

The feature is off by default.3 In the CLI, developers turn it on with /computer on, check its status with /computer show and turn it off with /computer off. The Copilot app has a matching toggle in Settings.1 On macOS, Copilot walks users through granting Accessibility and Screen Recording permissions.1 Under the hood, the agent reads the operating system's accessibility tree and takes screenshots when it needs them. Status checks report on a bundled computer-use plugin and its MCP server.5

GitHub's launch examples are ordinary office tasks: summarizing browser notifications, updating a presentation, and moving information through a desktop workflow.1 That choice says something. GitHub is presenting the feature as a general way to automate work on a machine, not as a debugging aid for developers.

GitHub is catching up, not leading

Computer use is new to Copilot, but not to terminal coding agents. One account of the launch says GitHub is following capabilities that OpenAI's Codex and Anthropic's Claude Code and Cowork had already shipped.7 The release history supports that.

Anthropic got there first. On March 30 it announced that Claude Code could open apps, click through interfaces and test what it had built, all from the CLI. The feature launched as a research preview on Pro and Max plans.23 Its documentation says the CLI version runs only on macOS, needs a Pro or Max subscription, and is not offered on Team or Enterprise plans.21 Windows users have to use Claude's Desktop app for computer use. A GitHub issue asking for Windows support in the CLI was marked stale in July.2127 In that thread, one commenter argued that Windows support isn't a simple switch, because Windows exposes interface elements differently and would need a second backend.27

OpenAI took a different route. GPT-5.4 arrived in Codex in March as OpenAI's first general-purpose model with built-in computer use.18 An April update let the Codex app operate macOS apps, though not in the EEA, UK or Switzerland at first. Windows support came on May 29, and Enterprise customers outside those regions got access in June.18 Since then OpenAI has added more on top: Record & Replay turns a workflow you demonstrate into a reusable skill, and a locked-use mode lets Codex keep working in approved apps after a Mac locks.1812

The coverage disagrees on one point. An unofficial Codex CLI guide says Codex computer use runs inside an OpenAI-managed isolated browser.15 OpenAI's own changelog describes the Codex app operating desktop apps by seeing, clicking and typing.18 This article goes with the official changelog. On that reading, OpenAI's desktop computer use lives mainly in its app, not the terminal.

So GitHub isn't first. What sets it apart is coverage: it shipped computer use in the terminal on both macOS and Windows at launch, and gave enterprises a way to manage it. Neither rival has that combination in a CLI today.

Governance is the selling point

Admin control is the clearest difference in GitHub's approach. A single managed-settings key, features.computerUse, lets enterprise administrators block the feature, and users can't override it locally.4 The control is narrow, though. It covers only the Copilot CLI and the Copilot app, not VS Code, the cloud agent or JetBrains.4 When organizations block the feature, the CLI tells users that managed settings prevent it.6

For users, approvals happen per app. When the active permission mode calls for it, Copilot asks before controlling an app. Users can allow it for the session, choose "Always allow", or decline.4 Deny rules beat saved approvals, and pressing Escape twice stops a running action in the CLI.6 One detail stands out: an "Always allow" granted in the CLI also applies to the Copilot app on the same computer.5 One analysis adds that removing an app from the allowed list does not cancel permissions for sessions already running.10

Compare Anthropic. Its CLI approvals last for the current session only, and permissions are tiered by app type: browsers and trading platforms are view-only, terminals and IDEs are click-only, and other apps get full control.26 GitHub's model is more flexible and easier for enterprises to fit into existing policy. Anthropic's is stricter by default. Persistent approvals are convenient, but they make it easy to hand over more access than intended.

Where the coverage disagrees on risk

Reporters disagree about how much safety guidance GitHub has published. One comparison says GitHub hasn't released detailed guidance on what computer use should and shouldn't touch during the preview, which leaves teams to set their own limits.2 Other reports point to fairly specific documentation. It warns that Copilot can pick the wrong control, type in the wrong place, or struggle with interfaces that change on screen.8 It also flags stalls and the risk that sensitive information on screen ends up in the agent's context.7

The most likely explanation is that both are true. GitHub has documented the failure modes well, but it hasn't said which apps are safe to automate. That decision is left to each organization. One analysis also notes that GitHub's pages don't say which Copilot plans include computer use.4

GitHub's own advice is notably cautious. It tells users to reach for APIs, MCP servers, terminal commands, filesystem tools or browser tools first, because they give more structured and predictable results.3 One headline summed this up as GitHub telling users to try something else first.7 Anthropic does the same: Claude Code uses an MCP server or Bash when one fits and only falls back to computer use when nothing else will do.21 All of the major players treat screen control as a last resort.

What it means for developer tools and SaaS

The common fallback design says a lot about the market. Legacy line-of-business software, internal admin panels and desktop-only tools have long been out of reach for AI agents because they have no programmatic interface. Computer use gets agents into those systems without waiting for vendors to build MCP servers. For SaaS companies, that cuts both ways. Agents can now use their products without official integrations, but vendors also lose some control over how their interfaces get automated.

The category is also moving fast. A side-by-side look at October releases shows Codex CLI at version 0.162.0 with managed Git worktrees and pinned tasks, Claude Code at 2.1.296 with model pinning and subagent-controlled context compaction, and the open-source OpenCode at 1.18.35 with signed macOS binaries.2 Release numbers like those mean weekly shipping, not quarterly. Developers choosing a terminal agent are choosing between products that all change quickly.2

GitHub is also building up safety controls around agents. Coverage of the same release cycle describes a new public-preview sandbox in the Copilot app. It limits filesystem access, network access and Git credentials per project, to contain the damage if an agent runs a command it shouldn't.5 Together with the computer-use controls, this suggests GitHub's pitch to enterprise buyers rests on governance more than raw capability.

Microsoft runs a separate version of the same idea. Copilot Studio's computer use runs on the agent's own computer and limits it to an allow-list of sites and apps. GitHub's version runs on the developer's own Mac or Windows machine.6

What to watch

GitHub's move is less a breakthrough than a sign the field is converging. All three major vendors now have computer use, and all three describe it as a fallback with approval gates. The open questions are reliability, what it costs, and who can use it. GitHub hasn't said how many plans get the feature, what usage limits apply, or when it will reach general availability.24 Until it does, the practical advice is the same across the coverage. Start with read-only tasks, keep approvals limited to the session, and tell the agent explicitly not to change values or submit forms until you've seen how it behaves.610

The next real test is Windows terminal support. GitHub has it in its CLI, and Anthropic's CLI doesn't.2127 Windows-heavy enterprise shops may find that gap matters more than which model scores highest on benchmarks.