Qwen-CUA Reaches 86.2 on Verified Computer Use

Computer-use agents promise a general route to operating software without bespoke integrations, but the interface is unforgiving: an agent must infer state from pixels, preserve context across many steps, and recover from actions whose consequences may only become clear later. Qwen-CUA addresses that setting with a native agent that receives screenshots and issues keyboard and mouse events, deliberately excluding DOM trees, accessibility metadata, and task-specific APIs. The paper's central argument is that large-scale, verifiable interactive training can make this interface competitive across a broad mix of software tasks.

Core Contribution

The contribution is less a new mouse-control primitive than a training and systems recipe for scaling visual computer use. Qwen-CUA uses a Qwen mixture-of-experts backbone with 397B total parameters and 17B active parameters, then trains on complete interactive trajectories rather than treating interface actions as isolated predictions. The authors pair approximately 40,000 verifiable tasks with personalized long-horizon workflows and a rollout fleet built around nearly 100,000 vCPUs and tens of thousands of concurrent environments.

That distinction matters because sparse task completion is difficult to optimize directly. The paper uses verifiable rewards where possible, slices trajectories to create more usable learning signal, and refreshes supervised data and reinforcement-learning tasks between development runs. Figure 2 presents this as an iterative scaling process: performance rises with model, task, and infrastructure scale, while successive checkpoints are trained against updated data and task pools.

Technical Approach

At inference time, the scaffold keeps up to 20 screenshots active and compresses older visual history in fixed-size blocks. The stated aim is practical rather than merely architectural: retain recent evidence needed for the current screen while keeping reusable prompt prefixes stable enough to avoid rebuilding the entire context at every interaction. The agent therefore operates from visual observations alone, with its action space restricted to ordinary keyboard and mouse events.

The training setup combines supervised trajectories with reinforcement learning over full workflows. Verifiable outcomes supply a cleaner reward signal than subjective judgments for tasks such as completing a sequence in an application, while personalized workflows widen the task distribution beyond narrowly scripted benchmarks. The paper also evaluates browser deployment and Bash-augmented behavior, suggesting that the authors view native GUI operation and explicit tools as complementary rather than mutually exclusive.

Results and Analysis

Across eight benchmarks, the 397B-A17B model reaches 86.2 on OSWorld-Verified. On OSWorld 2.0 it records 18.5 binary completion and 48.4 partial completion. Scaling the same recipe to Qwen-CUA-Max, a model with more than one trillion parameters, raises those figures to 87.6 and 21.2/53.3 respectively. These are useful gains, but they are not uniform evidence that scale alone solves long-horizon interaction: the absolute binary-completion score on OSWorld 2.0 remains low, even when partial completion is substantially higher.

Figure 3 separates efficiency into output tokens per task on OSWorld-Verified and agent turns per task on OSWorld 2.0. The distinction is well chosen: a model can reduce textual deliberation without necessarily reducing interface interaction. The authors caution that turn counts are interface-dependent because GPT-5.5 and Claude Opus 4.8 can emit multiple actions per turn, whereas Qwen-CUA emits one. That makes cross-model turn comparisons informative but not a clean hardware- or action-normalized efficiency measure.

The security result is also material. Relative to Qwen3.7, RedTeamCUA attack success falls from 36.6 to 16.4. This supports the narrower claim that the new training recipe improves performance under that red-team evaluation; it does not establish safety across arbitrary web content or software environments. Taken together, the benchmark breadth, scale study, and security evaluation make a credible case for screenshot-native agents as a usable foundation, while the remaining gap between partial and full task completion shows where reliability still constrains deployment.