GitHub Copilot computer use: roll out desktop automation without losing permission control
Quick answer
GitHub released computer use in public preview for local Copilot CLI and app sessions on macOS and Windows. It can read app content and visual context, click, type, scroll, drag, and cross desktop workflows. Start with GUI-only work lacking a reliable direct tool. Keep approval session-scoped, confirm writes, record the observed result, and test live stopping separately from removing a saved approval.
Who this is for
This guide is for teams evaluating Copilot for legacy software, presentation editing, cross-app data movement, or other GUI-only tasks. On Macs, enabling it also requires Accessibility and Screen Recording permissions.
For hosted browser automation, use the separate OpenAI Agents API computer-use checklist. This article is about a local agent controlling native desktop applications.
What changed and why it matters
GitHub announced the preview on October 1, 2026. Computer use is disabled by default and works in local Copilot CLI and Copilot app sessions. The official documentation says the feature is intended for applications without a more direct integration. When an API, MCP server, terminal command, filesystem tool, or dedicated browser tool can do the job, GitHub recommends that route because it is more structured and predictable.
The critical boundary is permission lifetime. Allow grants app access for the current computer-use session. Always allow saves the approval locally and shares it between Copilot CLI and the Copilot app on the same computer. Removing that saved approval changes future sessions; it does not revoke access already granted to a running session. Stop the active operation, then end the session, when you need to revoke current authority.
The feature remains public preview. Availability is not evidence that a particular workflow is safe, deterministic, or complete.
Permission and control map
| Control | Scope | What it proves | What it does not prove |
|---|---|---|---|
| Enable Computer Use | Local Copilot surface | Tools may be offered | Any app is approved |
| macOS Accessibility | OS helper | Controls may be operated | The target action is intended |
| macOS Screen Recording | OS helper | Windows may be inspected visually | Visible data is safe to expose |
| Allow | Current computer-use session | One app may be controlled now | Every write is authorized |
| Always allow | Future sessions on this computer | Approval can be reused by CLI and app | Current action is correct |
| Remove saved app | Future sessions | Reuse is revoked | Running access has stopped |
Stop / Esc |
Active operation | Execution is interrupted | External side effects were rolled back |
Organization-managed settings and explicit deny rules can still disable or block the feature. A local toggle cannot override enterprise policy.
A seven-step rollout workflow
1. Prefer the most direct tool
Inventory the task before granting desktop control. Use an API for structured records, a CLI for deterministic commands, MCP for typed tools, and the browser tool for web-only flows. Reserve computer use for the visual gap those routes cannot cover.
2. Write a bounded task contract
Name the application, target window, allowed reads, allowed writes, stop condition, and forbidden actions. “Open the finance app and fix it” is unsafe. “Read the status panel; do not edit, submit, export, or open another account” is testable.
3. Start with a read-only canary
Use synthetic or non-sensitive data. Ask Copilot to open one application, summarize a known field, and stop. Confirm the observed value manually. Do not grant Always allow during the canary.
4. Add one reversible write
Use a disposable document or test account. Require a preview before the write, then compare the final state with the requested state. Capture app, window, action, timestamp, result, and reviewer outcome without storing unnecessary screenshots or personal data.
5. Test the two revocation paths
While an operation is active, use Stop in the app or Esc twice in CLI. Separately remove the app from Always allowed apps and prove a new session asks again. These tests cover different permission lifetimes.
6. Reconcile uncertain effects
If timing, focus, or a dynamic control makes the result unclear, observe the target before retrying. Desktop automation can click the wrong control or repeat an action when window state changes. Never retry a submit, send, delete, or payment action from transcript state alone.
7. Canary and rollback
Roll out one app and one low-impact workflow. Stop on wrong-window actions, repeated input, missing approval, sensitive-data exposure, unverifiable completion, or enterprise-policy drift. Keep the direct manual path available until receipts are stable.
Task contract template
application: "Presentation Test"
target_window: "Q4-demo-copy.pptx"
goal: "Replace the subtitle on slide 2"
allowed_reads: ["slide titles", "speaker notes on slide 2"]
allowed_writes: ["slide 2 subtitle"]
forbidden: ["send", "publish", "delete", "open other files"]
approval: "current session only"
stop_after: "show final slide 2 without saving"
verification: "human compares requested and observed subtitle"
Common mistakes
- Using computer use when a typed API or CLI already exists.
- Treating Accessibility or Screen Recording permission as task authorization.
- Choosing Always allow for password managers, finance apps, admin tools, or other high-impact software.
- Removing a saved approval while assuming the running session has stopped.
- Retrying an uncertain GUI submission without reading the resulting state.
- Calling a completed tool trace proof that the intended business action succeeded.
Make your Mac notch useful with SuperNotch—more than 20 native tools for music, clipboard, focus, screenshots, system controls, and more.
FAQ
Is GitHub Copilot computer use generally available?
No. GitHub documents computer use as a public preview that is subject to change.
Does it work on Linux?
The documented computer-use preview is available for local sessions on macOS and Windows. Do not infer Linux desktop control from general Copilot CLI support.
Does removing an always-allowed app stop the current session?
No. It removes the saved approval for future sessions. Stop the active operation and end the session to revoke access already granted to that session.
Should I use computer use for a web app?
Prefer a dedicated browser tool when it can complete the flow. Use desktop control only when the task genuinely crosses into a native or GUI-only application.