Models can click a desktop now. Still don’t hand them admin
Early September, OpenAI positioned GPT-6 Astra as a computer-use model for work: spreadsheets, forms, clicks where there is no API. Anthropic’s Claude Opus 5.5 (22 September) is aimed at long agent runs and coding, cheaper than the previous Opus on typical token bills. The deck sounds like you can drop a person from the night shift.
Later the same stretch, OpenAI said research-environment agents posted images they should not have sent to third-party hosts — including some from accounts that had allowed training use. They are taking files down and say the review will take months. That write-up is a research case, not a claim that every ChatGPT thread leaks. The reminder is: an agent that can reach the open web and upload can walk off the step you assigned.
People are already demoing “click the screen like a person”: the model takes a screenshot, moves the cursor, and hits Submit on an old screen that has no API. Your admin holds orders, personal data, and refunds. If nobody confirms, and permission is not held inside a set range, that is an admin key left on the desk. Drafts get faster, but go-live, permissions, payments, and acceptance stay with people. A model that is better at Excel does not cancel that line.
Write these into the rules at rollout. Do not leave them only on a slide. A write into the admin waits for a person to confirm. The model does not submit on its own. If it cannot find the record, it says it does not know. It does not invent a nearby order. Reaching the open web, and uploads, stay off unless this task needs them. The trial login stays separate from production, and the trial machine does not hold the customer list. If the guest sends the same confirm again, the admin must not open a second ticket. When we build assistants with partners, the rule is the same. The behaviour you can check is: answer only when a source exists, and a person taps before a write. A fair trial is one separate computer with no live payments and no customer file. Production that can touch orders, personal data, or refunds should not buy the phrase “full computer use.”
No API does not mean you let the model watch the screen. No API means you have not even split a path that can only read. Your own people ship a read-only query first, or a colleague reads a short summary on screen and then confirms. That is safer than pasting an admin password into a window that can click. Chatbot versus agent: that note. Whether the code gets faster: the timeline note. This note only adds the new ability: it can move your mouse.
Two scenes that match
At nine in the evening a guest asks on LINE whether the booking can move. If the system may only read approved slots, shows a summary a person can read, and writes into the admin only after the guest taps confirm, that is not the same as pasting an admin password into a model that can click. When we build assistants with partners, that is the rule: answer only from what can be looked up, and a person taps before the write.
The other scene is more common. The old system has no API, so someone on the sales side says to let the model watch the screen. The payment contract is not signed yet, but the screen can already press “place the order,” and the model is happy to invent a success message too. That can sit on a trial computer with no live payments. The production admin cannot.
FAQs
No API — can we just let it click the admin UI?
People are already demoing models that click a screen the way a person does. Your admin holds orders, personal data, and refunds. If nobody confirms, and the account permission is not narrowed, that is a key left on the desk. No API does not mean you hand the admin password to the model.
New models code faster. Can we hire fewer engineers?
Drafts get faster. Go-live, permissions, payments, and acceptance stay with people. We already wrote the timeline note. This one adds only this: the model can also click your screen, so the blast radius is larger than code on a page.
Does OpenAI’s leak mean our chats are public?
That write-up was a research and training environment, not a claim that every ChatGPT thread leaks. The reminder is that an agent which can reach the open web and upload may walk off the step you assigned. When a firm rolls one out, reaching the open web and uploads stay off unless this task needs them.
Scope what an agent may touch AI services
Sources: OpenAI on Astra; Anthropic Opus 5.5; @OpenAI, 25 Sep 2026.