You leave an agent working inside a Windows sandbox and go back to your Mac. It takes a screenshot, opens a native application nobody ever wrote an API for, types into three fields, saves, screenshots again to check the figure landed where it should. You watch none of it. Your cursor never jumps, no window comes forward, the mail you are writing is never interrupted. In the morning the work is done and correct. Then you try to answer one question about the night — whose account was it typing under — and find you have no idea.

The exchange tests the line without ringing

A handset is something you pick up. It works while you hold it, does nothing while you don’t, and when you put it back the story ends. The line behind it is a different object. It arrives at the building whether anyone is home or not, it is registered to somebody who pays for it, and most of what happens to it happens with the handset on the hook. Someone at the exchange can measure the pair and hold traffic off it, and at your end the bell never rings.

An agent that drives a desktop lives on the line side of that difference. One kit raises a virtual machine or a container for whichever platform the work needs and hands the agent what a person at a computer has: a screenshot, a mouse, a keyboard, a shell. A native driver takes instructions from a command line or over MCP while the application being driven stays in the background. Nothing is taken from you: not the cursor, not the focus, not the front window. That is what carries computer use past the browser, out to the applications a company runs, which have no API and never will.

A common interface does not make platforms equal

The kit is the same on macOS, Windows and Linux. What it talks to is not. Permissions differ, focus rules differ, and what a program may inject as input while it sits in the background differs most of all: on Linux the compositor can refuse it outright, turning working automation into a silent no-op on the platform you tested last. The calls look identical, which is the trap. They are three contracts wearing one signature.

That is where the administrator’s questions begin, and they are not questions you ask of an app. Who starts this, and does it come up before anyone logs in. Under which account does it act, its own or yours, and can you tell the two apart in a log later. What can it see of the other programs on the machine. Who can stop it, and from where. A desktop driver with nothing underneath it is a fine answer for work you trust and a poor one for anything else, because its reach is your reach — the case for keeping it in a sandbox even when the task looks dull. An agent measured only on browser tasks has been measured on the easy half of the job, which is why the benchmarks built for this record whole trajectories across real desktop work.

Privacy becomes the system’s job, not the app’s

Push the harness down another floor and the agent stops being a program on the operating system and becomes part of it: a first-class actor that composes applications, command-line tools and APIs into whatever was asked for. Ask for a view of your health and it assembles one from what four applications hold separately, keeping memory across them and running in the background, decoupled from the display.

The old party line is the right worry. Where several houses shared one circuit, anyone could lift the receiver and hear the neighbours, and no household could fix that alone — it was a property of the plant. An agent with memory across your applications is on a party line with all of them, and no single application can decide what leaks, so the system holds that decision instead. Values travel with taint metadata, so where something came from moves with it. Sensitive ones are passed as protected references: the confirmation reaches you while the value never reaches the model, the way the exchange connects a call without listening. A payment waits for consent, like a reverse-charge call waiting for someone to accept it, and an access nobody supported fails closed, like a barred number.

Most of this is still prototype, and mistaking a good demonstration for something ready to carry security-critical work is the error it invites. An app is something you open. A service runs whether you are watching or not, and the question stops being what it can do and becomes who it is while it does it.