Qwen-CUA: Native Computer Use for (almost) Everything

2608.02352 ↗ · 2026-08-03 · cs.LG, cs.CL · h-max 27 · 0 citations

Dunjie Lu, Shuai Bai, Tianyi Bai, Sicheng Fan, Chang Gao, Jian Guan, Feng Hu, Mianqiu Huang, Xingyang Huang, Yizhen Jiang, Yuheng Jing, Dehui Kong +34

24 pages, 10 figures. Technical report

The finding

Headline claim

A 397B-parameter mixture-of-experts model trained end-to-end on native screenshot-only computer use, with large-scale verifiable RL, achieves state-of-the-art agentic benchmark scores, outperforming GPT-5.5 and approaching Claude Opus 4.8 on OSWorld-Verified while halving adversarial attack success rates.

The test

Qwen-CUA was evaluated on eight computer-use benchmarks including OSWorld-Verified, OSWorld 2.0, MyPCBench, MacAgentBench, Gym-Anything, ScienceBoard, and RedTeamCUA. The model uses only screenshots and keyboard/mouse events, no DOM or accessibility metadata. Training used ~100,000 vCPUs, ~40,000 verifiable tasks, and iterative RL with Soft Adaptive Policy Optimization (SAPO). Baselines include Qwen3.7, GPT-5.5, and Claude Opus 4.8 under the same native computer-use protocol.

Effect size & scope

OSWorld-Verified: Qwen-CUA 86.2 vs. Qwen3.7 73.3, GPT-5.5 78.7, Claude Opus 4.8 83.4. OSWorld 2.0 binary/partial: 18.5/48.4 vs. 2.5/22.5 for Qwen3.7. RedTeamCUA attack success: reduced from 36.6 to 16.4. Scaling to 1T+ parameters (Qwen-CUA-Max) raises OSWorld-Verified to 87.6 and OSWorld 2.0 to 21.2/53.3. Gains hold across all eight benchmarks but scope is limited to controlled benchmark environments; real-world generalization is partially demonstrated via an internal Chrome deployment and MyPCBench experiments.

Limitations

Authors acknowledge that native GUI interaction is slower and less reliable than API or code-based alternatives for tasks where those interfaces exist. Benchmarks are still narrow relative to the full space of real-world workflows. The internal Chrome deployment is described qualitatively, not quantitatively. Personalized workflow data collection relies on annotators, limiting scale and diversity. RL training shows high variance per checkpoint, and the selected checkpoint (40 of 50) was chosen by held-out validation, raising overfitting concerns. The model is not publicly released with weights, limiting independent replication.

Counterpoint

All evaluated benchmarks are constructed by the same or closely affiliated research community, creating potential overfitting to evaluation conventions. The "native-only" protocol excludes API-augmented baselines that would be used in production, making comparisons flattering to Qwen-CUA's design choices. Scores on OSWorld 2.0 remain low in absolute terms (21.2 binary), meaning the vast majority of complex tasks still fail. The trillion-parameter Max variant is not practically deployable for most users, and the core 397B model's inference cost is unstated.

Economy implication

If benchmark gains translate even partially to real workflows, enterprises can begin to automate GUI-only software tasks without custom integrations, reducing the labor cost of operating legacy and specialized desktop software. However, OSWorld 2.0 binary scores below 25% indicate current agents still fail most complex tasks, so at-scale labor substitution in unstructured GUI environments remains 18 to 36 months away. The massive compute infrastructure required (100,000 vCPUs for training alone) reinforces that frontier agentic capability remains concentrated among well-resourced labs, with little near-term commoditization of this specific capability tier.

Who this matters for

Technical Capability: Qwen-CUA demonstrates that screenshot-only agents trained with verifiable RL at scale can approach or exceed proprietary frontier systems on standardized GUI benchmarks, setting a new bar for open agentic systems.

Market & Valuation: Alibaba's release of a competitive computer-use agent narrows the perceived capability gap with Anthropic and OpenAI in the agentic product layer, with implications for enterprise automation software vendors and RPA incumbents.

Labor & Knowledge Work: A credible GUI agent that can operate legacy desktop software, professional tools, and personalized workflows without APIs could eventually displace knowledge workers performing routine GUI-mediated tasks, though current binary completion rates remain too low for unattended deployment.

Bears on (advisory · papers never write evidence)

[1.1] Frontier benchmark scores kept rising gen-over-gen through 2025–26.

[1.3] Agentic reliability (multi-step completion without human correction) is improving materially, not just peak single-shot.

[3.1] Inference cost per unit of capability is falling rapidly.

[5.1] Frontier models cluster tightly (small gaps, fast catch-up).

[B1] Agentic reliability gains will translate into enterprise ROI.

Abstract

Native computer use offers a general interface for agents to operate almost any software available to people, but requires long-horizon state tracking, large-scale interactive experience, and learning from sparse yet verifiable outcomes. We introduce Qwen-CUA, a native computer-use agent with a 397B-A17B Qwen mixture-of-experts backbone. It observes only screenshots and acts through keyboard and mouse events, without DOM trees, accessibility metadata, or task-specific APIs. Its scaffold maintains up to 20 active screenshots and folds older visual history in fixed-size blocks to retain recent evidence while preserving reusable prompt prefixes. For training, we build a cloud rollout fleet with access to nearly 100,000 vCPUs and tens of thousands of concurrent environments, construct approximately 40,000 verifiable tasks, and collect personalized long-horizon workflows across everyday and professional software. We optimize complete trajectories with verifiable rewards and trajectory slicing, while iterative training runs refresh supervised data and recalibrate reinforcement-learning tasks. Across eight benchmarks, Qwen-CUA outperforms Qwen3.7 and remains competitive with leading proprietary systems, reaching 86.2 on OSWorld-Verified and 18.5/48.4 binary/partial completion on OSWorld 2.0. Scaling the same recipe to a model with over one trillion parameters yields Qwen-CUA-Max, improving these scores to 87.6 and 21.2/53.3. Qwen-CUA also reduces RedTeamCUA attack success from 36.6 to 16.4 relative to Qwen3.7. Efficiency analyses, a browser deployment, and Bash-augmented experiments further characterize practical behavior. These results establish native computer use as a broadly capable agent foundation and highlight scalable verifiable interaction and hybrid tool use as key directions.