Cursor says its agents can now operate any app on your computer. In two posts on X on October 23, 2026, the company introduced a tool called Computer Use that lets agents "click and type across any app on your computer, not just the browser," and showed agents driving the iOS Simulator to test features they have just built. It ships as a software update. Agents can call the tool on their own when a task needs it, or you can @-mention "Computer Use" in a prompt.
That is the short version. The useful version separates what Cursor has said, what its documentation already confirms, and what nobody has published yet. At publication time, Cursor's changelog had no entry for this release, so some details below are marked unconfirmed.
TL;DR: the questions people ask first
| Question | Answer |
|---|---|
| What is it? | A Computer Use tool that lets agents click and type in any desktop app |
| Headline demo | Agents testing built features in the iOS Simulator |
| How to use it | Agents invoke it automatically, or @-mention "Computer Use" |
| How do I get it? | Software update, per Cursor's post |
| Is the idea new in Cursor? | Cloud agents already use a desktop and browser in a VM |
| Official docs or changelog entry? | Not yet found at publication time |
| Main risk | An agent with OS-wide control can touch far more than your repo |
What Cursor actually said
Cursor's account on X described the feature in two lines, both quoted in public reporting: that Computer Use lets agents click and type across any app on your computer, "not just the browser," and that agents can drive desktop apps such as the iOS Simulator "to test the features they build." Reporting on the posts adds that you can trigger it by @-mentioning Computer Use.
That is all that has been published. We found no accompanying blog post, pricing note, permission model, or list of supported operating systems. Treat any claim beyond those two lines, including supported platforms and plan limits, as unconfirmed until Cursor documents it.
What Cursor's docs already confirm about computer use
The feature builds on something Cursor already shipped for the cloud. The Cloud Agents documentation says cloud agents "use computers to control the desktop and browser," and the capabilities page explains the mechanics: each agent runs in an isolated VM with a full desktop, and it "can use a mouse and keyboard" to "start dev servers, open the app in a browser, click through UI flows, and verify their changes work before pushing a PR."
Three details from the docs are useful for understanding the new local version:
- Artifacts. Cloud agents attach screenshots, videos and log references to the pull request as proof of what they did, so reviewers do not need to check out the branch.
- Remote desktop control. You can take over the agent's desktop, test the software yourself, then hand control back.
- Self-hosted machines. Cursor's docs say you can start a worker with a
--computer-useflag so the agent can drive that machine's desktop; macOS workers use a "Cursor Computer Use helper app" and Linux workers use an X11 display.
That helper-app detail hints at how a local Mac version would work, but the docs describe self-hosted workers, not your daily laptop. Whether the new feature uses the same helper or a different mechanism is not stated.
Why the iOS Simulator is the demo
Mobile developers have had a gap in agent workflows. An agent can write SwiftUI code, build it and read the logs, but verifying that a screen looks and behaves right needs someone to tap through it. The Simulator is a normal macOS window, not a web page, so a browser-only tool cannot touch it.
Computer Use closes that loop: build, launch the Simulator, tap, read the screen, fix, repeat. It is the same idea as the browser testing agents already do for web apps, extended to anything with a window. Third-party tools such as RocketSim already let agents in Cursor and other AI IDEs control the Simulator, so a built-in option moves Cursor into that space.
How this compares with other computer-use agents
Cursor is not alone. Claude Code added a built-in browser in its desktop app, OpenAI is wiring computer use into agents such as Ironclad's contracting agents on GPT-6 Astra, and open projects like Alibaba's OpenGCUA target general desktop control.
What differs is the surface. Cursor's agents already live next to your code, your terminal and your cloud environments. Adding the desktop gives the same agent the ability to build, run and visually verify, without a separate computer-use product. For more on Cursor's agent infrastructure, see our post on Cursor cloud agents on your own infrastructure.
It also fits a pattern in Cursor's recent releases: Projects with coordinator agents on September 10, Rollouts and Security Review on September 23, an iOS app with Remote Control for local agents on October 6, and cloud-agent canvases and environment improvements on October 16, all listed in the changelog. Remote Control keeps agents running on your computer while the phone app connects to them, which makes a local Computer Use tool a natural next step: your phone can start the task, your machine does the clicking.
A cursor arrow reaching toward a glowing button, illustrating Cursor Computer Use agents clicking in desktop apps
What to check before turning it on
Computer use raises the stakes compared with a code-only agent. The agent is no longer limited to the repository and the terminal.
- Permissions. On macOS, controlling other apps usually needs Accessibility and Screen Recording permissions. Know exactly which app receives them and revoke when finished.
- Scope of what is visible. If the agent takes screenshots, anything on screen (messages, password managers, banking tabs) can end up in the model's context.
- Prompt injection through the UI. An agent that reads a web page or app window can be steered by text in it. A malicious string in a test page is enough to try to redirect a click-capable agent.
- Irreversible actions. A mouse can press "Send," "Delete" or "Buy." Prefer a dedicated test account, a separate macOS user or a VM for any task that touches real services.
- Logs and approvals. Ask whether each click is logged, whether you can require approval for sensitive apps, and whether enterprise admins can disable the feature. None of this is documented yet for the new tool.
If you run coding agents on real machines, a guardrail layer that blocks dangerous actions before they execute is worth adding; AgentBeam, built by the explainx.ai team, is one option. It is a complement to, not a substitute for, using an isolated environment.
A safe first experiment
Until Cursor documents the permission model, a cautious trial looks like this:
- Update Cursor and read the release notes in the app for any new permission prompts.
- Use a throwaway project with a small SwiftUI or Electron app, and a spare macOS user account with nothing signed in.
- Write a narrow prompt, for example: "Build the app, open it in the iOS Simulator, tap through the onboarding flow, and report any screen where a button is cut off. Do not open any other app."
- Watch the first runs live. Note which apps the agent touches, how many screenshots it takes, and whether it asks before leaving the Simulator.
- Check the diff and the usage dashboard afterwards. If token use looks high, shorten the task or ask for fewer screenshots.
If the agent behaves, widen the scope gradually. If it wanders outside the named app, tighten the prompt or switch it off. Browser-based testing that Cursor's cloud agents already offer is the safer comparison point when the thing you need to verify is a web UI.
What this means for what you build or pay
- Mobile and desktop developers get the most: end-to-end checks in Simulator or Electron apps without writing UI-test scaffolding.
- Cost. Cursor's docs say cloud agents bill at the selected model's rate against your plan usage, and screenshots-in-the-loop work typically consumes more tokens than text-only edits. Pricing for the new tool has not been stated, so watch your usage dashboard in the first week.
- Team policy. If your company restricts desktop automation, check with your admin before enabling it; Cursor's enterprise controls for the feature are not yet documented.
What we still do not know
- Which operating systems and Cursor versions support it.
- Whether it works in the IDE, the agents window or the CLI.
- Whether it is available on every plan or only paid tiers.
- How permissions and approvals are presented to users.
- Any benchmark of how reliably it completes multi-step UI tasks.
We will update this post when Cursor publishes a changelog entry or documentation.
Related reading
- Cursor cloud agents on your own infrastructure
- Claude Code Desktop: built-in browser
- Ironclad contracting agents and computer use on GPT-6 Astra
- Alibaba OpenGCUA: open generalist computer-use agents
- Agent source control: Scion versus Git versus Cursor Origin
- Cursor staff probe over confidential client data
Details are accurate as of October 23, 2026, based on Cursor's X posts and public documentation; features and availability may change.