Computer use compared: who gets to touch your Mac.

Computer use went from conference demo to product category in about eighteen months. Anthropic shipped Claude Cowork as a research preview in January. Manus put a desktop app on the Mac in March. OMEGA ships plain-English control of the Mac and the browser as a core feature. Three products, one underlying question: what should an AI agent be allowed to touch on a computer, and who decides.

One of the three is ours, so apply the appropriate discount while you read. I will try to earn the benefit of the doubt the only way a comparison can, by being specific about what the other two get right.

The hard part was never the clicking

By computer use I mean an agent that operates software the way you do: opening applications, clicking controls, typing into fields, moving files, driving a browser session. Not a chat window with a code sandbox bolted on. The agent acts on real state in real applications, where mistakes cost something.

Getting a model to click buttons stopped being the hard part some time ago. Frontier labs were demoing it in 2024, and today every major model can look at a screenshot and propose a plausible next action. The hard part is everything around the click. Which applications the agent is allowed in. What happens when it misreads the screen. How you find out, afterward, exactly what it did. Whether you can stop it mid-motion when you see it heading somewhere wrong. Each product in this comparison is really a bundle of answers to those four questions, and the answers differ a lot more than the demos do.

Claude Cowork: scope by folder

Cowork is Anthropic's desktop computer-agent, launched as a research preview in January and aimed at non-technical knowledge work. You choose folders, and the files inside them become the agent's working world: it can edit what is there and create what is missing. Under the hood it runs the same agentic core as Claude Code, which is worth pausing on. That core drives one of the most capable coding agents in existence, and here it is pointed at documents instead of repositories.

The folder boundary is the right instinct, and I want to say so plainly before I argue with its limits. Scope that maps to the job is the cleanest kind of safety there is. If the job is cleaning up a directory of contracts, or turning forty research notes into a briefing, a boundary drawn at the folder is exactly as big as the task and no bigger. Nothing outside the folder is reachable, so nothing outside the folder is at risk. There is no permission dialog to misread, because the grant happened the moment you picked the folder.

The limit is just as plain: it is file work. A folder boundary only means something when the job lives in files. The moment a task spans applications, the folder has nothing to say. Pull numbers from a web dashboard into a spreadsheet, check a detail in Mail before renaming the attachment, file the result in another app's library: none of that fits inside a folder, and Cowork's preview does not attempt it. That is not a knock on the preview. Anthropic drew a small circle on purpose and is learning inside it, which is a defensible way to ship an agent. It does mean Cowork currently answers a narrower question than the other two products here.

Manus My Computer: distance as a safety model

Manus came at the problem from the opposite side. It made its name as a cloud agent: you hand it a task, and the work runs on machines in the cloud until results come back. Meta acquired Butterfly Effect, the company behind it, in December. In March the My Computer desktop app arrived on the Mac, and the cloud agent gained reach into your desktop.

The cloud-first shape buys something real. The work does not need your Mac. Close the lid and the task keeps running, because it never ran on your hardware to begin with. Long jobs do not tie up your machine, and several can run at once without your fans making the case against it. For fire-and-forget research and web tasks, that is a genuinely better shape than anything that needs your screen awake. I will come back to this, because it is the strongest argument against our design and it deserves a straight answer rather than a subject change.

The cost is that distance cuts both ways. When the work happens on someone else's machines, your working context goes there too: the documents the task reads and the credentials it uses. And when the agent reaches back down into your desktop, the control plane still lives at the far end of the wire. You can read a log afterward, but the action happened at arm's length, on your machine, driven from somewhere else. Plenty of people accept that trade with open eyes. I do not, and OMEGA exists partly because I do not.

OMEGA: the agent works where you can watch it

OMEGA starts from a different premise: the computer being used is yours, so the person watching should be you. You ask in plain English. Rename every PDF in the March invoices folder to date and vendor, then file them by quarter. Find the pricing table on this page and put it into a spreadsheet. When a step needs the Mac, OMEGA operates the Mac itself, in the same applications and the same browser you use. The Neural-Fractal Agentic AI™ (NFA) engine that routes every OMEGA turn decides when a step needs hands on the machine at all, so trivial questions stay trivial and never touch your desktop.

Four things gate it, and together they are the product.

• Per-app approval gates. The first time OMEGA wants to drive a specific application, it asks, and the grant is for that application. There is no single "control my computer" toggle, because a blanket grant is not a decision, it is a surrender. Approve Finder and you have approved Finder. Mail stays closed to the agent until you say otherwise.
• Watch-it-work transparency. The actions happen on your screen, in front of you, at a pace you can follow. This sounds like a demo feature. It is a safety feature. An agent that misreads a screen makes its mistake in front of you, in the second before it matters, instead of in a log you read tomorrow.
• An audit trail. Every action is recorded: which app, which control, what was typed, in what order. When a run does something you did not expect, you reconstruct it exactly instead of guessing from the wreckage.
• Emergency Halt. One control, always available, stops everything now. Not "finish the current step." Now.

None of this is exotic engineering, and that is sort of the point. A permission model is a set of product decisions, and it is where the three products in this post genuinely differ. The full model is documented on our security page.

Failure modes are the real comparison

Abstract safety talk is cheap, so walk through what actually goes wrong. These are the failures I worry about, because we have met a version of each while building this.

The misread instruction. You said the March folder; the agent resolves the wrong one and starts renaming two hundred files. Under folder scoping this is contained, provided you picked the folder yourself, which is a genuine point for Cowork's design. Under a pure cloud agent, you find out when the results come back. On OMEGA, the wrong folder opens on your screen while you watch, and Emergency Halt is one motion away. The audit trail then lists exactly which files were touched before the stop, so the cleanup is a checklist instead of an archaeology dig.

The shifted click. A web page reflows and the click meant for Archive lands on Delete. No permission model prevents this; it is the irreducible risk of driving a GUI, and anyone who claims otherwise is selling something. What the model changes is blast radius and detection time. An agent confined to applications you granted, moving at a pace you can follow, turns a silent error into a visible one, and a visible error gets caught in seconds instead of surfacing next week.

The hostile page. Text on a webpage instructs the agent to do something you never asked for. Prompt injection against browser-driving agents is not hypothetical, and a vendor who sells computer use without mentioning it is leaving out the part that matters. Scoped grants are the mitigation that holds. An injected instruction cannot open an application you never approved, and an exfiltration attempt has to execute on your screen with a halt control under your hand. I will not claim the risk goes to zero; nothing takes it to zero. I claim the failure becomes visible and interruptible, and against this class of attack that is worth more than any promise about model virtue.

The runaway loop. The agent gets stuck retrying a click that will never work, or worse, an action that partially succeeds each time. On OMEGA a stuck run is visible within seconds and Emergency Halt ends it; budgets cap what any runaway can spend on model calls along the way. A loop you can see is an annoyance. A loop you cannot see is a bill.

Where the cloud agents are ahead, and what we did about it

Now the straight answer I promised. OMEGA's desktop control needs your Mac awake, and it is designed to run with you nearby, because being watchable is the point. That choice costs us the overnight case for desktop work. Manus keeps going while your laptop sits closed in a bag. On this axis the cloud agents are simply ahead, and no amount of safety framing changes it.

Our answer is to split the problem rather than pretend we solved all of it. Recurring, structured work does not belong in a desktop session at all. It belongs in an Automation. You describe the job in plain English or import an existing n8n graph and wire up a trigger or a schedule. From then on it runs on OMEGA's always-on VPS runner whether your Mac is awake or not. The nightly report and the seven a.m. inbox triage are runner work; they never needed your desktop in the first place.

What stays on the Mac is the work that deserves eyes on it: one-off manipulation of your real files and your real browser sessions. That split is a deliberate line, not a gap we are waiting to close. If a job is regular enough to run while you sleep, it should be an Automation with a defined shape and a schedule, reviewed once and trusted thereafter. If it is a one-off with your actual data on the table, I want it on your screen. What we genuinely do not offer is closing the lid mid-session and having the desktop work continue somewhere else. If that single capability matters most to you, Manus is the better tool today, and I would rather say so than blur the line that makes our approach worth having.

Choosing

Where each one fits.

Cowork fits when the job is knowledge work that lives in documents and you want the least possible ceremony around it. The folder is the scope, and the agentic core underneath is excellent. Its circle is small; inside it, it is very good.

Manus fits when you want to hand off whole tasks and collect results, and you are comfortable with the work, and the context it needs, living on machines that are not yours. The always-on property is real, and for desktop sessions I have not matched it.

OMEGA fits when the work has to happen on your actual Mac and you want every grant to be one you made, every action to be one you could watch and stop. Computer use here is a native capability of an Apple Silicon app on macOS 14 or later, not a remote session pointed at your screen. The wider comparison lives on the compare page, and pricing is public. If you try one thing, give OMEGA a tedious file job and watch the whole run, including pressing Emergency Halt once just to feel it work. The permission model is the product, and you should get to inspect it with your own eyes.