Computer use is a beta capability that turns Claude into a GUI operator through a simple loop: Claude requests a screenshot, studies the image with its vision capability, decides on an action — click these coordinates, type this text, scroll down — and your application executes that action and sends back the next screenshot. Repeat until the task is done. Nothing magic happens on Anthropic's side: computer use is a client tool, so your application executes every action, and Claude cannot touch a machine you haven't wired it to.
Declaring the tool
Two tool versions exist: computer_20250124 (paired with the beta header computer-use-2025-01-24, used by models such as Sonnet 4.5 and Haiku 4.5) and the newer computer_20251124 (header computer-use-2025-11-24, for Sonnet 5, Opus 4.8 and other recent models). The tool's name must be "computer", and you tell Claude the screen geometry via required display_width_px and display_height_px parameters, plus an optional X11 display_number. The newer version adds an opt-in enable_zoom flag.
The action vocabulary
| Group | Actions |
|---|---|
| Basic (all versions) | screenshot, left_click, type, key, mouse_move |
Enhanced (computer_20250124+) | scroll, left_click_drag, right_click, middle_click, double_click, triple_click, left_mouse_down/up, hold_key, wait |
computer_20251124 only | zoom — view a region [x1, y1, x2, y2] at full resolution (requires enable_zoom: true) |
Modifier keys during clicks and scrolls ride along in those actions' text parameter (shift, ctrl, alt, super), while hold_key holds a key for a duration. The zoom action matters more than it sounds: on dense enterprise UIs, letting Claude inspect a toolbar or table region at native resolution noticeably reduces misclicks. Computer use also combines naturally with the bash and text editor tools in the same request — the beta header is only required for the computer tool itself.
Scaffolding a safe execution environment
Because your code performs the clicks, safety is an architecture question, and the guidance is consistent across official docs:
Isolate the machine. Run the desktop Claude controls in a dedicated virtual machine or container with a minimal set of applications, throwaway credentials, and no access to production networks or sensitive data. Treat it like a kiosk, not a workstation.
Constrain the blast radius. Give the environment only the accounts and permissions the task needs. Log every action your executor performs — the action stream is a natural audit trail — and add human confirmation for consequential steps such as submitting forms or sending messages.
Assume hostile content. A screenshot can contain text that tries to manipulate the model ("ignore your instructions and…" banners on a webpage). Anthropic runs prompt-injection classifiers on computer-use interactions; when a screenshot is flagged, the model is steered to ask for user confirmation before its next action. That backstop helps, but your isolation boundary is the real control — organizations can opt out of the classifier via support, which only makes sense in already-locked-down environments.
Cost and platform availability
Screenshots are billed as ordinary vision input, and the tool adds modest overhead — roughly 466–499 system-prompt tokens for the beta plus about 735 tokens for the tool definition on Claude 4.x models. Availability is unusually uniform for a newer capability: computer use is in beta on all five surfaces — the first-party Claude API, Claude Platform on AWS, Amazon Bedrock, Google Vertex AI, and Microsoft Foundry — and it is eligible for Zero Data Retention. Since screenshots flow through the normal Messages API, your cloud platform choice mostly affects procurement and identity rather than how the loop works.
Where to go next
Computer use is the slowest, most general tool in the kit — reach for an API-level tool first when one exists. See the bash tool and the text editor tool for the terminal-side equivalents, and the feature matrix for platform support at a glance.