Compared

Frontier-lab computer use and the Agent Machine Interface.

Computer use is a model that comes with its own environment, and the target has to be able to run that environment. AMI is a set of eyes and hands that sits outside the target altogether. Where the agent sits decides what it can reach, what it exposes, and how much damage a compromise can do.

Seven differences.

Trust boundary. Computer use runs inside the machine it operates, in a vendor VM, a browser, or a service on the host. AMI runs outside it, on hardware the operator owns.
Reach. Computer use needs a running operating system to live in. AMI only needs the machine to have a screen and accept a keyboard, so it works on firmware screens, installers and locked-down appliances.
Attack surface. Computer use puts a privileged program on the target, along with its updater and everything in the vendor's supply chain. On Windows that includes a service running as Local System from boot. To the target, AMI is a keyboard and a mouse. Nothing is installed.
Blast radius. If a computer-use agent is compromised, the attacker gets whatever the host process has. Under Local System, that is the whole machine. If AMI is compromised, the attacker gets one account's keyboard and a view of the screen. That account is chosen once, at setup.
Egress. Computer use sends screenshots, page structure, files, clipboard contents and shell output back to the vendor. That is how it works. AMI sends video and audio, and there is no other channel.
Model. Computer use is the vendor's model running in the vendor's loop. AMI is a skill any model can load, hosted, local or open weights. Run locally, nothing leaves the network.
Retention. Computer use keeps a transcript of screenshots. AMI keeps keyframes and the changes between them, not the raw frames.

Residual risk.

Computer use. A compromise brings the vendor's supply chain, privilege escalation through the Local System service, and a larger attack surface on the target itself. It is capped by what can be accessed, not by what is on screen: files, clipboard, sessions, a shell, and the network the host can reach.

AMI. A compromise, through the machine driving it or the key, is capped by what can be seen. The attacker gets the screen and a keyboard, as one account, and nothing the screen does not show.

Where each wins.

Computer use. Wins where the target can run software and the vendor is already trusted on it. Page structure beats pixels: faster to start, more precise to act.

AMI. Wins where the target cannot or must not run software: firmware, installers, appliances, isolated or allowlisted machines. The price is pixels instead of structure, and a slower start.

Side by side

Row by row.

This is about design, not performance. It says which machines each one can reach and what a compromise would cost, not which one is better at operating a desktop.
 Computer use Agent Machine Interface
Product
Form A model plus a hosted environment Eyes and hands for any model
Delivery Vendor product A skill the agent loads
Model Vendor's, or framework-compatible Any: hosted, local, open weights
Reach
Agent location Inside the target: vendor VM, browser, container Outside the target, on the operator's host
Target prerequisite Running OS and browser, or vendor agent A screen, and a socket for a keyboard
Pre-boot: BIOS, firmware, installers Unreachable Reachable
Appliances and locked devices Web UI only Console, as an operator would
Signal
Source Screenshots, plus the structure underneath the page What is on the screen, and what it plays. Nothing underneath it
Input to the agent Screenshots, the structure underneath, files, command output The picture, the text on it, parts of it on request, and sound
Retention A transcript of screenshots What changed, not every picture
Egress from the target Screen, page structure, files, clipboard, shell output Video and audio. Nothing else
Keyboard Synthetic OS or browser events Everything a real keyboard does: chords, hold, modifiers
Control loop Seconds per step via hosted API Faster than a person, model excluded
Security
Credentials on target Agent signs in, or inherits a session None. The target account is the sole gate
Attack surface added A privileged agent on the host, its update channel, its vendor's supply chain None on the target. The machine driving it, the key where there is one, and the model if it is hosted
Compromised agent can Act as the host: sessions, files, clipboard, shell Act as one account, through keyboard and mouse
Privilege ceiling The permissions the client runs under The account dedicated to it
Untrusted input reaches the agent via Screen, page structure, files, shell output Screen only
Control owner Vendor, plus the account the agent signed into The operator: the account, and custody of AMI
Recovery
Undo and rollback What the application and hypervisor offer Same
Time
Deploy Under an hour A couple of hours
Configure a target Minutes A couple of hours
Use Minutes Minutes

The economics

What makes it robust is what stops it scaling.

A script is told what to click. An agent is told what you want. That one difference decides both what survives a page that has changed and what the thing costs to run, and the two move in opposite directions.

Everything below stops a script, and none of it stops something that can see:

The button now says Notify Me where it said Add to Cart.
A waiting room appears where the product used to be.
What is in stock is a bundle, or a reseller at three times the price.
The session has expired, or a banner is sitting over the thing.
The layout moved, so the instruction points at nothing.

A script meets any one of these and either stops, or carries on and does the wrong thing with confidence. Something reading the screen sees what actually happened and decides again.

And the same property caps it

Reading and deciding costs time and a call to a model on every step. That is the price of surviving the unexpected, and it is also why there is no version of this that runs ten thousand times over for nothing.

A script is cheap, brittle, and scales without limit. This is the reverse of all three, and not as a matter of policy.

The trade is not incidental. It is the same property read two ways.
 A script An agent, through AMI
Each action fast, close to freeslow, and it costs something
A page it did not expect stops, or proceeds wronglylooks again, decides again
Ten thousand at once trivialnot at any sensible price

So the tool that suits repetitive abuse is not this one, and the tool that suits work nobody could write down in advance is. That is a cost structure rather than a promise about intent, which is the only kind of assurance worth much.

Next

SecurityThe threat model, stated first, and where the boundary really sits.What to expectWhat it does well, what it cannot do, and what surprises people.Talk to usDescribe the machines and the job.