Coding agents have spent two years writing code and then asking a human to check whether it works. On October 23, Cursor closed part of that loop: a feature called Computer Use lets its agents click and type inside desktop applications, including the iOS Simulator, to test the feature they just built.
The workflow is the one developers used to do by hand. Ask the agent to implement something, then have it launch the app, walk the flow, find the failure, fix the code and repeat the same steps against the changed build. A concrete example: the agent enters "Buy coffee" in a notes app, presses Save, checks that exactly one note appears with that text, then tries saving an empty field and a field containing only spaces — neither should add anything. Finally it closes and reopens the app to see whether the note survived.
That last step is the interesting one. A screenshot taken after pressing Save only proves what appeared at that moment. Reopening the app is what tests persistence — and that is precisely the class of bug unit tests miss, because the code compiles perfectly while the button writes an empty string, saves the note twice, or does nothing at all.
Cursor's own caveats are worth repeating. The agent can choose Computer Use when a task needs it, or you can call it explicitly by mentioning it in the prompt; the client must be up to date. On macOS it needs two permissions: Accessibility to interact with apps, and Screen Recording to capture the interface. Both are granted to a separate helper named "Cursor Computer Use" — granting them to your terminal does not grant them to the helper, and neither does granting them to Cursor itself.
That permission model is where the story stops being purely about productivity. Accessibility on macOS is not a narrow interface: an app holding it can drive whatever is on screen, in any window, not just the simulator. Handing it to an agent means handing it to a process executing instructions generated by a language model. The sensible mitigations are organisational rather than technical: work against a development copy with disposable data, keep tasks small enough to review, do not leave the agent running alongside a password manager and a logged-in browser, and use a separate machine or VM when a flow needs restarts or desktop state changes.
Cursor already separates execution contexts. Its built-in Browser remains the right tool for web forms because it can read console and network errors. Cloud Agents get their own desktop in a remote VM, isolated from the apps on your laptop. Self-hosted workers support computer use on macOS and Linux, enabled with --computer-use.
The limits matter too. For a pure function or an API response, going through the graphical interface is wasted motion. Computer Use earns its place exactly where the failure is only visible in the running interface: a form that discards input, a preference that resets when the window closes, a button that does nothing on the device even though the code looks correct.
An agent that can see its own work is a real step for anyone who has spent afternoons clicking through UI changes. It is also one more permission an agent can inherit from a dubious instruction. Both halves belong in the same decision.
