Most automation needs an API. A great deal of enterprise software does not have one, or has one that covers a tenth of what the interface can do. Computer-use agents work around that by using the interface the way a person does.
The loop is short. The agent receives a screenshot, a goal, and its action history. A multimodal model reads the screen, decides on the next action, and emits it as a coordinate to click or a string to type. The environment executes it, takes a new screenshot, and the loop runs again.
This unlocks legacy desktop applications, internal portals, and vendor tools nobody will ever build an integration for. It also fails in ways API automation does not. A dialog appears in an unexpected place and the run derails. Success rates on public benchmarks such as OSWorld remain well below what people achieve on the same tasks.
The security posture matters more than the capability. An agent with a mouse can do anything the logged-in user can, so scoped accounts, a sandboxed machine, and confirmation before irreversible actions are the baseline.