Computer-Use Agents vs RPA in 2026: What AI That Operates Screens Can Replace

A computer-use agent is an AI model that operates software the way a person does. It takes a screenshot, decides what to click or type, acts, and looks again, until the task is done. Robotic process automation (RPA) also works through the screen, but a bot follows steps a developer recorded in advance and breaks when a field moves. The agent decides its path at run time, so it copes with changing layouts and messy input, and it can also choose a wrong path. Since 2025 every major model vendor and every RPA vendor has shipped a version of computer use, and the question for anyone running a bot estate is which work moves, which stays, and how to prove the agent did it right.

• 36%of OSWorld tasks a strong agent completed on all ten of ten runs, against about 78% completed at least once⁴
• 3%correct values written by some agents on ERP tasks where they saved the record in up to 85% of runs³
• 38xthe cost of a computer-use step against a deterministic flow action in Microsoft Copilot Studio⁶

What the benchmarks measure and what they leave out

The best-known test is OSWorld, a set of desktop tasks in a virtual machine. On its cleaned-up version, OSWorld-Verified, the top 2026 entries run from 83.4% to 86.1%, and every one is reported by the vendor that built the model. The leaderboard that collects them warns that rows "can vary by evaluator, harness, attempt budget, tool access, task filtering, or verification level".¹ The human score usually set beside them, 72.36%, was measured on the original 2024 task set.⁹ Stanford's AI Index 2026 put agents at 66.3% on OSWorld, "within 6 percentage points of human performance", in data that is already six months old.¹⁰

Longer work tells a different story. OSWorld 2.0, released in June 2026, has 108 workflows that take a person a median of about 1.6 hours and an agent an average of 318 tool calls, against about 30 in the original. At launch the best agent completed 20.6% of them.¹¹ Anthropic's system card for Claude Opus 5.5 reports 48.7% completed on a strict measure and 81.8% on partial credit.² Tests built on real business applications show the same drop as tasks get longer.

Two lessons follow for buyers. A high general score does not predict results on your software: in ERPBench, Holo3-35B-A3B and Qwen3-VL-32B completed 34% and 32% of the simplest ERP tasks while Claude completed 94%.³ And the drop comes with length. UiPath's own researchers describe "a sharp capability cliff rather than gradual performance degradation" between simple and complex tasks.¹² We found no independent public test of computer-use agents on SAP, Workday or mainframe screens, so any claim about those systems needs your own trial.

Why one successful run is the wrong measure

A bot that posts invoices runs the same process thousands of times a month, so what matters is whether it succeeds every time. A 2026 study ran a strong agent, Agent S3 with GPT-5, ten times on each OSWorld task. It completed about 78% of tasks at least once, and all ten times for only about 36%.⁴ SaaS-Bench saw one model score anywhere from 0 to 0.679 on the same task across runs, and set out the arithmetic of long work: at 95% accuracy per checkpoint across 12 checkpoints, the whole task succeeds only about 54% of the time.¹³

Most failures are failures of judgment. An audit of failed runs across five benchmarks traced 35.2% of genuine failures to planning and 39.3% to verification and feedback, with the largest single cause, at 29.5%, an agent repeating an action that did nothing. Clicking the wrong thing accounted for 13.9%.¹⁵ The failure that matters most to a finance team is the silent one. In ERPBench some agents saved the record in up to 85% of runs and wrote the correct value in as few as 3%.³ In LegacyWorld, Claude Opus 4.6 left unwanted changes behind in 10.7% of runs and Kimi K2.5 in 35.7%.¹⁴ SaaS-Bench documents agents claiming success after their own verification failed.¹³

Benchmarks carry their own error. The same audit found 15.3% of failure verdicts were wrong, 17.5% on OSWorld and 21.7% on WebArena.¹⁵ Agents are also slow. The best take 2.7 to 4.3 times more steps than necessary, and a late step can take three times longer than an early one.¹⁶ In ERPBench, Claude Sonnet 4.6 spent 89 seconds and 231,000 input tokens on a single record, and 323 seconds and about 2 million input tokens on a chained workflow.³ At today's $2 per million input tokens for Claude Sonnet 5.5, that is roughly $0.46 and $4 a run before caching, by our arithmetic.¹⁷

The one controlled test against an RPA bot

Researchers at the Technical University of Liberec built the same three processes in UiPath and with Anthropic's computer-use agent on Claude Sonnet 4, then ran each ten times. The tasks came from rpachallenge.com, a set of exercises the RPA community uses to test bots.⁵

The authors call the agent "not yet production-ready" and found it far quicker to build.⁵ The bot was faster on every task, and the differences in reliability were too small a sample to be statistically significant. The study used a 2025 model, and later benchmarks point the same way: agents trade run time and repeatability for build time and tolerance of change. That trade decides where each one belongs.

What computer use costs

Model vendors now bill computer use as ordinary tokens, and the buyer runs the browser or virtual machine. Microsoft and Amazon sell it as a metered unit. RPA vendors sell bots by the month and agent calls by platform credit.

Microsoft is the one vendor that prices a bot, a deterministic flow and a computer-use step side by side, which makes it a clean comparison. A flow action costs 13 credits per 100 actions and a computer-use step costs 5 credits, about 38 times more.⁶ One hosted Power Automate bot at $215 a month buys the same as about 26,900 credits, or roughly 5,400 standard computer-use steps.²⁶²⁴ At 30 steps a task, that is about 180 agent tasks a month. The arithmetic leaves out build and maintenance labor, which is most of what RPA costs, but it shows where the line falls. On a stable screen running several hundred times a month, the bot is cheaper to run. On a screen that runs a few dozen times a month or changes every quarter, the agent's shorter build and lower upkeep can win.

How RPA has actually performed

The most quoted statistic about RPA, that 30% to 50% of projects fail, comes from a 2016 EY paper, where it is an observation about first projects: "we have seen as many as 30 to 50% of initial RPA projects fail".²⁹ There is no survey behind it. The better evidence points at upkeep, scale and measurement. HFS Research estimated that licenses are "just 25% to 30% of total costs for implementing RPA".³⁰ Deloitte's 2020 survey found 37% of organizations piloting with 1 to 10 automations and 13% scaling beyond 50.³¹ Its next survey found the average payback period for those still piloting had grown from 16 months in 2020 to 22 months.³²

US government auditors give the clearest record. The inspector general for the General Services Administration found that the agency's claim that its RPA program reclaimed more than 240,000 work hours a year was "inaccurate and unreliable", and that GSA was not tracking what its bots cost.³³ A 2024 follow-up counted 119 active and 24 decommissioned bots, found no process for removing retired bots' access, and found that program management "simply removed or modified the requirements" it could not meet.³⁴ HUD's inspector general concluded that after more than three years its program "had achieved minimal progress and results".³⁵ Measurement, cost tracking and machine identities are the same three problems agents bring, with less predictable behavior on top.

The RPA business itself is growing slowly. UiPath reported $1.938 billion of annual recurring revenue at July 31, 2026, up 12%, with $37 million net new.³⁶ Eighteen of its top 20 deals that quarter included AI, and its chief executive described the pitch plainly: AI "is probabilistic and can be expensive at scale", while many processes "need exactness, the same result every time".³⁷ Automation Anywhere says AI accounts for nearly 70% of its new and upsell bookings and that agent executions grew five times in a year.³⁸ Analysts expect slow adoption: Forrester predicted that fewer than 15% of firms will turn on the agentic features in their automation suites in 2026,³⁹ and Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027.⁴⁰

What deployments look like so far

We found no company that has publicly retired a set of RPA bots in favor of agents and published the before and after costs. The public cases follow two patterns. The first is computer use where no API exists. Graebel, a relocation company, uses Copilot Studio computer use because its globalCONNECT platform "doesn't expose APIs for this workflow". The agent reads service orders, works through the platform's screens and routes "low-confidence cases, exceptions, and approvals for human review". Microsoft describes it as a pilot covering "a small set of high-volume service order types" and publishes no figures.⁴¹

The second pattern is agents working alongside existing bots, which is how the RPA vendors sell. UiPath told investors it handles about 700,000 invoices a year for a Fortune Global 500 manufacturer, and reported 96% document accuracy in a proof of concept.³⁷ Amazon says Nova Act reached 90% reliability on browser workflows built by early customers, and that one startup client automates hundreds of thousands of workflows a month with it.⁴² These are vendor figures without independent measurement. In outsourced back-office work the effect so far shows up in revenue mix: Genpact's core business services grew 1.9% in its second quarter of 2026 while its technology business grew 24.1%.⁴³

Prompt injection is lower in vendor tests and still open

A computer-use agent reads untrusted content, web pages, emails, documents and screenshots, and acts on it with the access it was given. Text planted in that content can redirect it. Vendor measurements have fallen fast. In August 2025 Anthropic measured a 23.6% attack success rate for browser use without its mitigations and 11.2% with them.⁴⁴ A year later, on a harder set of attacks written by professional red-teamers, attacks succeeded against Claude Opus 4.5 17.6% of the time and against Opus 5 3.8% of the time before extra safeguards.⁴⁵ The Claude Opus 5.5 system card reports 0.07% in computer-use environments, two successful attempts out of 2,800. The same card reports 54.61% for an adaptive attacker in coding environments, falling to 11.13% with probes enabled, which shows how much the number depends on the setting.²

No one who builds these systems calls the problem solved. OpenAI has said its AI browser may always be vulnerable to prompt injection.⁷ The UK's National Cyber Security Centre said such attacks "may never be totally mitigated" the way SQL injection can be, and told developers to focus on secure design.⁸ Independent researchers keep finding working attacks. Brave showed in August 2025 that a hidden comment on Reddit could make Perplexity's Comet browser log into the user's account, read a one-time password from Gmail and send both to the attacker.⁴⁶ In academic tests, visual prompt injections fooled computer-use agents up to 51% of the time and browser agents up to 100% on some platforms,⁴⁷ and WASP found attacks partly succeeding in up to 86% of cases while agents completed the attacker's goal in 0 to 17%, which its authors call "security by incompetence".⁴⁸ That margin shrinks as agents get better at finishing tasks.

Legal and regulatory limits

Which mechanism for which step

The decision is made step by step, and one process usually ends up mixing an API call, a bot, an agent and a person. The order of preference that the evidence supports is an API first, a deterministic bot second, an agent third, and a person for anything that cannot be checked automatically.

How to start in eight weeks

1. 1List the screen work Inventory every bot and every manual screen task with its monthly volume, how often the screens change, and whether the system has an API.
2. 2Pick the long tail Choose three to five low-volume tasks with no API and frequent screen changes, which bots never covered economically.
3. 3Define correct For each task, write the database or API check that proves the work was done right, independent of what the agent reports.
4. 4Build the sandbox Give the agent its own virtual machine, its own least-privilege identity, a domain allowlist and no stored passwords.
5. 5Run it ten times Run every task repeatedly on real cases and count how often it succeeds on all runs, alongside the time, steps and cost per run.
6. 6Price at real volume Compare the cost per task at your monthly volume, including review time for exceptions, with a bot or a person doing the same work.
7. 7Go live with a queue Send low-confidence cases and failed checks to people, record every session, and widen the scope only when the numbers hold.

Clicking is close to solved in 2026. Doing a long task correctly every time, and proving it, is not, and that is the thing RPA's rigid design was built to guarantee. Agents earn their place where bots were always too expensive to build and maintain: the low-volume screens, the changing layouts and the messy input that stayed manual. The organizations that gain most will be the ones that write the checks, measure repeated runs and route each step to the cheapest mechanism that can be trusted with it.

This is how we approach screen automation in our AI agent development work: inventory the bot estate and the manual screen work, use APIs wherever they exist, give agents the long tail inside an isolated sandbox with their own identity, and put a database check and an exception queue behind every write.