The most interesting change in AI assistants is the move from explaining a task to operating the software needed to complete it. A desktop assistant may work with documents, use an app integration or click through an ordinary interface.
For someone who runs a small business, that opens possibilities beyond writing: organising files, assembling information and working across applications that do not connect neatly.
Codex is one example. OpenAI’s 16 April 2026 announcement described computer use alongside wider app support. That makes it worth understanding even if you never intend to write code.
Three capabilities that are easy to confuse
| Route | What it means | An illustrative task |
|---|---|---|
| File access | The assistant reads or edits permitted files directly | Extract dates from three documents into a new table |
| App integration | It uses a defined connection and the actions that connection exposes | Retrieve selected records from a supported service |
| Computer use | It operates an app through its graphical interface | Find an export control in an application without a suitable integration |
A product can combine these routes. Desktop installation does not mean that every task runs locally or that the assistant can use every application.
OpenAI’s current computer-use documentation covers supported macOS and Windows experiences, with availability and controls depending on the account and region. Check the requirements in your own app before choosing a task.
Where this could be useful
Consider a hypothetical business owner preparing for three supplier renewals. The relevant dates are spread across PDFs and a spreadsheet.
A bounded task is to read copies of those documents, build a comparison table and identify missing information. The owner can then check each row against its source.
A broader task—negotiate the renewals and update the accounts—adds communication, commercial judgement and authority. The same technology label should not make those two assignments seem equivalent.
Another useful experiment is asking the assistant to reproduce an export problem in a test application. It may help find the exact sequence of steps, even where a written description of the problem was unclear.
Desktop access also creates privacy and security risks
An assistant’s access may extend beyond the document you want it to work on. Depending on its permissions, it may see screen content, read files or interact with websites where you are already signed in. A customer email, payroll spreadsheet or personal message could become part of the task’s context if it appears in an accessible window. OpenAI’s computer-use guidance specifically advises keeping sensitive apps closed unless they are needed.
There is also a difference between software running on your desktop and information staying on your computer. Check whether the service sends screenshots, document contents or activity records to cloud systems, where they are processed, how long they are retained and whether they can be used for model training. These arrangements vary by product, plan and settings. Turning off training does not, by itself, establish that processing is local or that nothing is retained.
For an Australian business, this matters when customer or employee information is involved. The OAIC recommends examining an AI product’s data flows and who can access information supplied to it. Businesses covered by the Privacy Act still need to assess whether their intended handling of personal information is permitted; granting an app access is not a privacy assessment.
Access to actions adds another risk. An assistant could select the wrong file, send information to the wrong recipient or overwrite a record. If it can operate a signed-in account, an error can have consequences under your identity. Reviewing a result afterwards may catch a mistake, but it cannot reliably reverse information already disclosed.
Set the boundaries before the experiment
Australian cyber guidance recommends narrowly defined, low-risk tasks and the minimum permissions needed. For a first desktop experiment:
- Use fictional documents and copies of files. Keep customer records, passwords and financial accounts outside the trial.
- Review the actual file, screen, app and browser permissions. A test folder organises the work; it does not restrict access by itself. Use folder or app restrictions where supported. If access cannot be limited enough, choose a separate test environment or a task that needs less access.
- Close unrelated sensitive apps, disable unnecessary connections and use a signed-out browser for public research. A separate browser profile can separate web accounts, but it does not restrict access to the rest of the desktop.
- Stay present, find the stop and permission-revocation controls, and keep sending, payments, deletion and account changes outside the first trial. A written instruction needs support from the controls the product actually provides.
A twenty-minute experiment
Create a test folder with three fictional supplier documents. Include one renewal date, one expiry date and one document with no date.
Ask:
Create a new table listing each supplier, the relevant date, what the date means and the source document. Mark missing information as unknown. Leave the originals intact and stop after saving the table.
Before starting, note how long you would expect the task to take manually. Afterwards, compare the output with every document. Count preparation, checking and corrections as part of the work.
The missing date is deliberate. It reveals whether the assistant invents a value to complete the table.
Browser access changes the exposure
Webpages, emails and documents can contain malicious instructions intended to redirect an assistant away from your task. This is called prompt injection. An instruction hidden in material being read might try to make the assistant disclose files or act through a connected account.
OpenAI describes this as an ongoing challenge in its discussion of the Atlas browser agent. Product safeguards can reduce the risk, but permission limits and human oversight still matter. A page or document that the assistant reads should not acquire the authority to approve a new action.
For a public research task, a signed-out browser may be enough. Avoid giving the task access to unrelated accounts simply because they are already open.
Choose the stopping point
For early experiments, stop at a saved draft or recommendation. Before allowing sending, deletion or record changes, establish what needs approval and what can actually be recovered.
Inspect the resulting file or system state. An assistant reporting that a task is finished is less useful than being able to see the correct result.
Desktop AI is worth exploring because it expands the kinds of work an assistant can attempt. Its usefulness becomes clearer through a task you can inspect, rather than through the speed of its clicks in a demonstration.
Read next: build a first AI workflow.