This story bundles three things: Anthropic's beta of background computer use in Claude Cowork and Claude Code, its August 20, 2026 general availability of computer use alongside the Skills API and Files API, and a report that Meta is testing a computer-use model called Ava. Each is just a capability launch on its own terms. The more useful question for builders is where each product places the trust boundary. Who holds the credentials, what the agent can reach, and what gets recorded?
This matters because computer-use agents act with whatever authority the screen, browser session or API key gives them. As these products move from demos to regulated workflows, the controls around the model start to decide whether a deployment is defensible. Those controls are permissions, secret handling, network scope and audit trails.
What we checked
- Agent execution products are differentiating on policy, credentials, isolation, and auditability more than on raw model choice. partly confirmed. Vendors are clearly shipping governance primitives: per-app permissions and blocklists, egress-time secret injection, 1Password autofill and just-in-time access, and credential proxies. Their launch messaging, though, still leads with capability and speed. Anthropic's GA post cites workflow time falling from 32 to 13 minutes and offers HIPAA eligibility as its only stated control. Audit features are mostly 'coming soon'. Nothing we found shows model choice has stopped mattering. [1][2][3][4]
- (Added) Does one vendor apply the same isolation model across all its computer-use surfaces? refuted. Anthropic's own docs describe two opposite models. Cowork desktop computer use has 'no sandbox between Claude and your applications'. Managed Agents runs each cloud session in an isolated container, keeps vault secrets outside it, and substitutes them only at egress to allowed hosts. [1][3]
- (Added) Is Meta's 'Ava' computer-use model a verified product? unresolved. The only source is TestingCatalog's own observation of app changes. It says Ava 'is not currently accessible' and cites no Meta announcement. [6]
What we found
- Desktop computer use in Cowork is a beta for Pro and Max plans. Team and Enterprise plans currently have no access. It runs in the Claude Desktop app on macOS and Windows, and background operation requires macOS 15 or later. Claude tries connectors first, then a browser, and only then direct screen control. It asks per-app approval and blocks investment, trading and crypto apps by default. [1]
- The same support article says plainly that 'computer use has no sandbox between Claude and your applications'. A link clicked in an approved email app can open in Chrome even without Chrome permission. It also calls the model's trained avoidance of risky actions not absolute. It says nothing about credential handling or audit logs, and it advises users to avoid banking, healthcare and government apps. [1]
- Anthropic's August 20, 2026 post makes API computer use generally available, with several actions per turn. It adds a browser use tool that pairs screenshots with page structure and makes computer use eligible for HIPAA workloads under Anthropic's BAA. The only isolation it describes is the code-execution sandbox where Skills run. Credentials are not discussed. [2]
- Managed Agents vaults, in beta under header managed-agents-2026-04-01, store per-user credentials as write-only values. An environment-variable secret appears inside the sandbox only as an opaque placeholder. The real value is swapped in at egress, and only for the credential's allowed hosts and for headers and/or body as configured. The docs list caveats: secrets returned by token exchanges arrive in the sandbox unredacted, SigV4-style signing breaks, vaults are workspace-scoped, and env-var credentials don't work in self-hosted sandboxes. Archiving a vault keeps its records for audit. [3]
- 1Password's March 17, 2026 Unified Access launch says Anthropic will integrate 1Password autofill into the Claude browser extension, Cowork and Claude Code, so Claude can log in 'with a user's consent'. It names Anchor Browser, Browserbase, KERNEL and Perplexity Comet as integrators and describes just-in-time access, least-privilege controls and auditability. Its own Audit feature, which records which credential was used, when and by whom, is marked 'coming soon'. [4]
- Infisical's open-source Agent Vault puts the same pattern in a separate layer. Agents route traffic through an HTTPS_PROXY, and a MITM proxy replaces dummy values with real credentials before forwarding. It can deny unmatched hosts and can log requests. It is labelled a preview whose API may change. [5]
- The Meta item does not support any conclusion. TestingCatalog reports a computer-use setting in Meta's desktop app and an Ava variant in testing, based on its own observations, and says Ava is not accessible. We found no Meta primary source. [6]
What it means
The emerging pattern is that agents should use credentials without ever holding them. Anthropic's Managed Agents vaults, Infisical's Agent Vault and 1Password's broker all converge on that idea: secrets are injected at egress or autofilled by a broker, and both the secret and the destination are scoped. The convergence is real, but it is happening in hosted or API runtimes. The consumer desktop product works differently. There the agent sees whatever is on screen and acts across apps with no sandbox, and per-app permissions plus a prompt-injection review are the main controls. 'Governed execution' therefore depends on the surface, not the vendor. A builder who reads 'Claude computer use is GA and HIPAA-eligible' should not assume desktop-level isolation exists.
In practice: run unattended or multi-tenant agents in hosted containers with limited network egress. Put credentials behind an egress-substitution vault or broker, restricted to allowed hosts and to header-only injection where possible. Do token exchanges yourself so short-lived tokens, rather than root secrets, reach the sandbox. Treat desktop computer use as a supervised, single-user tool and keep sensitive apps on a blocklist. Don't rely on vendor audit trails yet, because the key audit features are still announced rather than shipped. Log tool calls and credential use in your own layer.
Still open
- Has the announced 1Password autofill integration in Cowork and Claude Code actually shipped, and does it keep credentials out of screenshots and model context?
- Does Anthropic log desktop computer-use actions anywhere admins can review, and when will Team and Enterprise plans get access with org-level policy?
- Do the GA API computer use and browser use tools offer any built-in isolation or credential mechanism beyond what the developer provides?
- Is Meta's Ava computer-use model real, and how would it be sandboxed? No Meta primary source exists yet.