Compared

Frontier-lab computer use and the Agent Machine Interface.

Computer use is a model that comes with its own environment, and the target has to be able to run that environment. AMI is a set of eyes and hands that sits outside the target and plugs into its HDMI and USB ports. Where the agent sits decides what it can reach, what it exposes, and how much damage a compromise can do.

Seven differences.

Trust boundary. Computer use runs inside the machine it operates, in a vendor VM, a browser, or a service on the host. AMI runs outside it, on hardware the operator owns.

Reach. Computer use needs a running operating system to live in. AMI only needs a video output and a USB port, so it works on firmware screens, installers and locked-down appliances.

Attack surface. Computer use puts a privileged program on the target, along with its updater and everything in the vendor's supply chain. On Windows that includes a service running as Local System from boot. AMI shows up as a USB keyboard and mouse. Nothing is installed.

Blast radius. If a computer-use agent is compromised, the attacker gets whatever the host process has. Under Local System, that is the whole machine. If AMI is compromised, the attacker gets one account's keyboard and a view of the screen. That account is chosen once, at setup.

Egress. Computer use sends screenshots, page structure, files, clipboard contents and shell output back to the vendor. That is how it works. AMI sends video and audio, and there is no other channel.

Model. Computer use is the vendor's model running in the vendor's loop. AMI is a skill any model can load, hosted, local or open weights. Run locally, nothing leaves the network.

Retention. Computer use keeps a transcript of screenshots. AMI keeps keyframes and the changes between them, not the raw frames.

Residual risk.

Computer use. A compromise brings the vendor's supply chain, privilege escalation through the Local System service, and a larger attack surface on the target itself. It is capped by what can be accessed, not by what is on screen: files, clipboard, sessions, a shell, and the network the host can reach.

AMI. A compromise, through the controlling host or the daemon's key, is capped by what can be seen. The attacker gets the screen and a keyboard, as one account, and nothing the screen does not show.

Where each wins.

Computer use. Wins where the target can run software and the vendor is already trusted on it. Page structure beats pixels: faster to start, more precise to act.

AMI. Wins where the target cannot or must not run software: firmware, installers, appliances, isolated or allowlisted machines. The price is pixels instead of structure, and a slower start.

Side by side

Row by row.

This is about design, not performance. It says which machines each one can reach and what a compromise would cost, not which one is better at operating a desktop.
	Computer use	Agent Machine Interface
Product
Form	A model plus a hosted environment	Eyes and hands for any model
Delivery	Vendor product	A skill the agent loads
Model	Vendor's, or framework-compatible	Any: hosted, local, open weights
Reach
Agent location	Inside the target: vendor VM, browser, container	Outside the target, on the operator's host
Target prerequisite	Running OS and browser, or vendor agent	A video port and a USB port
Pre-boot: BIOS, firmware, installers	Unreachable	Reachable
Appliances and locked devices	Web UI only	Console, as an operator would
Signal
Source	Screenshots, DOM, accessibility tree	Pixels and audio off the wire. No DOM, no tree
Input to the agent	Screenshots, DOM, accessibility tree, files, shell output	Frames at 60 fps, on-screen text, region queries, audio events
Retention	A transcript of screenshots	Keyframes and deltas
Egress from the target	Screen, page structure, files, clipboard, shell output	Video and audio. Nothing else
Keyboard	Synthetic OS or browser events	USB HID reports: chords, hold, modifiers
Control loop	Seconds per step via hosted API	42 ms median action-to-visible, model excluded
Security
Credentials on target	Agent signs in, or inherits a session	None. The target account is the sole gate
Attack surface added	A privileged agent on the host, its update channel, its vendor's supply chain	None on the target. The controlling host, the daemon's key on the networked path, and the model endpoint if hosted
Compromised agent can	Act as the host: sessions, files, clipboard, shell	Act as one account, through keyboard and mouse
Privilege ceiling	The permissions the client runs under	The account dedicated to it
Untrusted input reaches the agent via	Screen, page structure, files, shell output	Screen only
Control owner	Vendor, plus the account the agent signed into	The operator: the account, and custody of AMI
Recovery
Undo and rollback	What the application and hypervisor offer	Same
Time
Deploy	Under an hour	A couple of hours
Configure a target	Minutes	A couple of hours
Use	Minutes	Minutes

SecurityThe threat model, stated first, and where the boundary really sits.What to expectWhat it does well, what it cannot do, and what surprises people.Talk to usDescribe the machines and the job.