Mage-VL-Cowork: Microsoft's 4B Agent Clicks or Codes

Microsoft has released Mage-VL-Cowork, a small open model that operates a computer by deciding, step by step, whether to click through an app’s interface or drop to a terminal and write code. The 4-billion-parameter model went up on Hugging Face on 30 October under the Apache 2.0 licence, which allows commercial use.

Microsoft’s Mage team sums it up as “one compact 4B policy that knows when to click — and when to code”. It reports a score of 66.0% on the OSWorld-Verified desktop benchmark. That is Microsoft’s own result and has not been independently reproduced.

In brief

Mage-VL-Cowork is a 4B open-weight computer-use agent that switches between mouse-and-keyboard actions and shell commands within one model.
Microsoft reports 66.0% on OSWorld-Verified, which it says is the best score among 4B models.
Microsoft says the agent should only run in an isolated sandbox.

How Mage-VL-Cowork chooses between clicks and code

Most computer-use agents either drive the screen like a person or call tools through code, and some use a separate controller to pick between the two. Mage-VL-Cowork does both inside a single model. “The same policy chooses the channel at each turn—and switches when the task calls for it,” says the project page.

It pairs Microsoft’s Mage-ViT vision encoder with Alibaba’s Qwen3-4B-Instruct-2507 language model and works within a 32,768-token window. It keeps the three most recent screenshots and folds older steps into short summaries. One channel sends clicks and keystrokes; the other runs a persistent shell and Python environment.

In one demo, the model edits a LibreOffice spreadsheet with Python in 39 seconds and six steps. Qwen3.6-27B, working through the interface alone, takes nearly ten minutes and 39 steps. In a second demo, it edits an image in GIMP and then checks the saved file in the terminal, while Qwen3.6-27B stops after seven minutes with a file that fails the task check. These are demos Microsoft chose, not a broad test.

What Microsoft says the benchmarks show

According to the technical report and project page, the model scores 87.5% on operating-system tasks and 62.7% on multi-application workflows. Microsoft puts the 66.0% overall result just ahead of Muse Glimmer-30B (65.9%) and Qwen3.6-27B (63.9%). The same table shows a 9B model, ScaleCUA-Qwen3.5-9B, higher at 68.7%, and frontier systems such as GPT-5.5 at 78.7%, above the 72.4% human baseline.

Training ran in five stages, ending with online reinforcement learning. Microsoft says that last stage added 10.16 percentage points over the previous version while cutting the average number of model calls per task from 21.57 to 18.77. A task generator called Mage-CUA-Forge produced 293,806 practice tasks across 6,915 skills, and Microsoft says it cut the cost of generating each task from $0.906 to $0.158. Demonstrations came from a GPT-5.4 teacher agent.

The code and model weights are public, so others can check the numbers.

Why a small agent that runs bash still needs a sandbox

A model this size could, in principle, run on a single workstation rather than in a data centre, which is why Microsoft frames it as a step for “on-device intelligence”. That cuts cost and keeps data local, but it also moves the risk onto the person running it. Microsoft’s own model card is blunt: the agent can execute “arbitrary shell commands” and is “designed and evaluated for isolated, disposable sandbox environments”. It asks users to block access to host files and local networks, keep credentials out of reach, and require human confirmation before irreversible actions.

Those warnings matter more for an open model than for a hosted one, because nobody stands between the download and a user’s own machine. The same tension runs through recent agent launches, from Cursor agents that can drive desktop apps to OpenAI’s GPT-6.1 Terra, built for computer use, and OpenAI’s decision to widen agent monitoring after an incident.

There is also a gap between benchmarks and real desks. OSWorld-Verified runs in prepared virtual machines with a 50-step limit, while real work brings untrusted web pages and documents that can carry prompt injection. Microsoft’s model card names that risk itself.

For open computer-use research, Mage-VL-Cowork joins Alibaba’s OpenGCUA and follows the push to cheaper computer-use models such as Claude Haiku 5.5. The useful next test is an independent OSWorld-Verified run on the released weights.