Skip to content

Computer Use: letting ChatGPT drive desktop apps

Setting up Computer Use, the system permissions it needs, the Windows foreground constraint, macOS locked use, and when to reach for a plugin or the built-in browser instead.

CurrentLast verified

Platforms

  • ChatGPT desktop app (macOS)
  • ChatGPT desktop app (Windows)

What the official documentation says

  • In supported regions, Computer Use is available in the ChatGPT desktop app on macOS and Windows with ChatGPT Work and Codex, and requires installing the Computer Use plugin.

    Computer Use

  • On macOS you grant Screen Recording so ChatGPT can see the target app, and Accessibility so it can click, type and navigate.

    Computer Use

  • Setup is done by selecting ChatGPT and switching to Work, or selecting Codex, then opening Plugins > Computer Use, installing the plugin, and turning on the MCP server and skill toggles.

    Computer Use

  • Settings > Computer use shows app access; apps you approve for future tasks appear in the Always-allowed apps section.

    Computer Use

  • On Windows, Computer Use runs on the active desktop and cannot operate in the background while you keep using the same Windows session, so it takes over the pointer, keyboard and foreground.

    Computer Use

  • You start a task by mentioning @Computer or @AppName in the prompt, or by asking ChatGPT to use Computer Use.

    Computer Use

  • If the target app exposes a dedicated plugin or MCP server, the documented advice is to prefer that structured integration for data access and repeatable operations.

    Computer Use

  • On Windows, persistent app decisions are stored in $CODEX_HOME/config.toml under [computer_use.windows] as always_allowed_app_ids.

    Computer Use

  • Locked use is for macOS only, and enabling it installs an Apple authorization plug-in that participates in the macOS unlock flow.

    Computer Use

  • The feature cannot automate terminal apps or ChatGPT itself, and cannot authenticate as an administrator or approve security and privacy permission prompts on your computer.

    Computer Use

  • Administrators can restrict which apps Computer Use can access and whether approvals can be saved, and can disable the feature with [features].computer_use = false in requirements.toml.

    Computer Use

It exists for work that needs eyes and a mouse

Computer Use lets ChatGPT see and operate graphical user interfaces on macOS or Windows. The documented positioning is restrained: use it for tasks where command-line tools or structured integrations are not enough — checking a desktop app, using a browser, changing app settings, working with a data source that has no plugin, or reproducing a bug that only happens in a GUI.

The same paragraph carries its own warning: because Computer Use can affect app and system state outside your project workspace, use it for scoped tasks and review permission prompts before continuing.

Those two sentences are the whole discipline of this feature.

Setup has two layers

The first layer is inside ChatGPT:

  1. In the desktop app, select ChatGPT and switch to Work, or select Codex.
  2. Open Plugins > Computer Use and select Install plugin if prompted. If it shows Enable, select that.
  3. Turn on the Computer Use MCP server and skill toggles, then select Try now.
  4. Open Settings > Computer use to review app access. Connected browser controls show a Manage action, and apps you approve for future tasks appear under Always-allowed apps.

The second layer is the operating system, and it differs by platform:

  • macOS — grant Screen Recording (so ChatGPT can see the target app) and Accessibility (so it can click, type and navigate) when prompted.
  • Windows — keep the target app visible on the active desktop.

The documentation draws a clean line between these: system permissions decide whether ChatGPT can see and operate apps at all, while app approvals inside ChatGPT decide which apps you allow it to use. File reads, file edits and shell commands still follow the sandbox and approval settings for the task.

The Windows constraint that changes how you plan

This one deserves its own heading, because it affects scheduling more than configuration.

On Windows, Computer Use runs on the active desktop. It cannot operate in the background while you keep using the same Windows session — expect ChatGPT to move the pointer, type, and take over the foreground while the task runs.

The documentation offers two ways around it when a task should continue while you step away:

  1. Keep the Windows device unlocked and connected to the internet, and use Remote from your phone to check progress or send follow-up instructions.
  2. Run the ChatGPT desktop app inside a Windows virtual machine, so Computer Use takes over the VM instead of your main desktop.

macOS is different: running a scoped task in the background while you keep working elsewhere is listed as one of its good fits.

Starting a task: name the target

Mention @Computer or @AppName in your prompt, or ask ChatGPT to use Computer Use. The thing that matters is describing the exact app, window or flow it should operate.

Both example prompts in the documentation show this. One: open the app with Computer Use, reproduce the onboarding bug, fix the smallest code path that causes it, and after each change run the same UI flow again. The other: open @Chrome and verify the checkout page still works after the latest changes.

Note the tail of the first example — "after each change, run the same UI flow again". It specifies the verification, not just the task.

Three cases where you should use something else

  1. The app has a dedicated plugin or MCP server → prefer that structured integration for data access and repeatable operations. Save Computer Use for when ChatGPT needs to inspect or operate the app visually.
  2. A web app you are building locally → use the built-in browser first.
  3. Anything needing a terminal → not possible. The feature cannot automate terminal apps, or ChatGPT itself, because automating them could bypass security policies.

It also cannot authenticate as an administrator or approve security and privacy permission prompts on your computer.

The safety checklist

The documentation closes with a list where nearly every line maps to a specific way this goes wrong:

  • Give ChatGPT one clear target app or flow at a time.
  • You can stop the task or take over your computer at any time.
  • Keep sensitive apps closed unless the task requires them.
  • On Windows, expect ChatGPT to take over foreground input; use a secondary device, a VM, or stop the task before using that desktop yourself.
  • Avoid tasks that require secrets unless you are present and can approve each step.
  • Review app permission prompts before allowing ChatGPT to use an app.
  • Use Always allow only for apps you trust ChatGPT to use automatically in future tasks.
  • Stay present for account, security, privacy, network, payment or credential-related settings.
  • Cancel the task if ChatGPT starts interacting with the wrong window.

There is one browser-specific note worth carrying too. If ChatGPT uses your browser, it can interact with pages where you are already signed in. Review website actions as if you were taking them yourself: web pages can contain malicious or misleading content, and sites may treat approved clicks, form submissions and signed-in actions as coming from your account. To keep using your browser while ChatGPT works, ask it to use a different one.

The administrator side

In managed workspaces, administrators can restrict which apps Computer Use can access and whether approvals can be saved, and can disable the feature outright with [features].computer_use = false in requirements.toml. If the feature is missing on a work machine, check that first.

How to do it

  1. In the ChatGPT desktop app, select ChatGPT and switch to Work, or select Codex.
  2. Open Plugins > Computer Use and select Install plugin if prompted; if it shows Enable, select that.
  3. Turn on the Computer Use server and skill toggles, then select Try now to start.
  4. Open Settings > Computer use to review app access; connected browser controls show a Manage action.
  5. On macOS, grant Screen Recording and Accessibility permissions when prompted.
  6. Start a task by mentioning @Computer or @AppName, naming the exact app, window or flow ChatGPT should operate.
  7. Review each app permission prompt during the run, and use Always allow only for apps you trust ChatGPT to use automatically later.

On Windows

  1. Keep the target app visible on the active desktop.
  2. Computer Use runs in the foreground on Windows — expect ChatGPT to move the pointer, type, and take over the foreground while the task runs, so you cannot use that session for anything else.
  3. For Windows tasks that should continue while you step away, keep the device unlocked and online and use Remote from your phone to check progress or send instructions, or run the ChatGPT desktop app inside a Windows virtual machine so Computer Use takes over the VM instead of your main desktop.
  4. The persistent allow-list lives in $CODEX_HOME/config.toml under [computer_use.windows] as always_allowed_app_ids, using the app identifier Windows Computer Use reports — an executable name, or an app user model ID for a packaged app.
  5. To revoke a saved decision, remove the app under Settings > Computer Use > Always allow.

On mobile

N/AComputer Use is a desktop app capability, documented as available in the ChatGPT desktop app on macOS and Windows. A phone does not run Computer Use itself; its role is to reach a configured computer through Remote to follow progress or send instructions.

Use cases

  • Testing a macOS app, Windows app or iOS simulator flow that ChatGPT is building.
  • Reproducing a bug that only appears in a graphical interface.
  • Changing app settings that require clicking through a UI.
  • Inspecting information in an app or data source that has no plugin available.

Common mistakes

  • Assuming you can keep working on Windows while a task runs. The documentation states plainly that Computer Use runs on the active desktop and cannot operate in the background there.
  • Using Computer Use for an app that has a dedicated plugin or MCP server. The documented preference is the structured integration.
  • Pointing Computer Use at a web app you are building locally. The documentation says to use the built-in browser first.
  • Giving one vague instruction that spans several apps. The guidance is one clear target app or flow at a time.
  • Selecting Always allow for an app you do not fully trust ChatGPT to operate on its own.

FAQ

Which system permissions does macOS need?
Two. Screen Recording so ChatGPT can see the target app, and Accessibility so it can click, type and navigate. If ChatGPT cannot see or control an app, open System Settings > Privacy & Security and check both for Codex Computer Use.
When is Computer Use the right tool, and when is it not?
The documented test is whether the task depends on a graphical user interface that is hard to verify through files or command output alone. Good fits include testing a desktop app ChatGPT is building, performing a task that requires your web browser, reproducing a GUI-only bug, changing settings that require clicking through a UI, inspecting an app or data source with no plugin, running a scoped background task on macOS, and workflows spanning more than one app. Against that: prefer a plugin or MCP server when the app has one, and use the built-in browser first for local web apps.
What is locked use?
A macOS-only capability — on Windows, Computer Use simply works in the foreground. Once enabled, it lets ChatGPT use Computer Use after your Mac locks, by installing an Apple authorization plug-in that participates in the macOS unlock flow. The documentation stresses that it is intentionally narrow: not a general-purpose remote-unlock path, and not something other apps or local processes can use.
What safeguards does locked use have?
Four are documented: the authorization window is short-lived and scoped to the current unlock attempt; automatic unlock is available only to ChatGPT during active Computer Use turns; ChatGPT covers every display while the desktop is temporarily unlocked; and if it detects local keyboard or pointer input it relocks the Mac and pauses automatic unlock until you unlock it manually.
What can it not do?
The documentation is explicit — it cannot automate terminal apps or ChatGPT itself, since automating those could bypass security policies, and it cannot authenticate as an administrator or approve security and privacy permission prompts on your computer. File edits and shell commands still follow the task's own sandbox and approval settings.

Official sources

These are the pages this tutorial is checked against. Follow them if you need the vendor's exact wording.

Source status