2026-08-03 · 6 min · agents · computer-use · open-weights · vision-language-models
Qwen-CUA, published earlier today, controls a full desktop from screenshots alone with a 397B-A17B mixture-of-experts model. Fara1.5, from Microsoft Research, does the narrower version of the same job -- browser only, no desktop -- at 4B, 9B, and 27B parameters, and ships all three sizes under the MIT license, weights included. That is two orders of magnitude smaller than Qwen-CUA's backbone, scoped to one surface instead of an entire OS, and open in a way Qwen-CUA specifically isn't: Qwen-CUA's repository is Apache-2.0, but its own README states plainly that "model weights are not included" -- paper and demo only. Fara1.5 publishes the checkpoints. The interesting question isn't whether the biggest Fara model is good. It's what the 4B-to-27B ladder says about how much capability a vision-only agent actually needs.
The same narrow interface, a much smaller model
Fara1.5 is a multimodal decoder-only model built on Qwen3.5, at three sizes, all trained the same way. Given a goal, the current screenshot, and the last three steps of history, it reasons in text and then emits exactly one action from a fixed vocabulary: click, type, scroll, drag, visit_url, web_search, go_back, plus meta-actions for longer horizons -- memorize to persist a fact past the three-screenshot window, ask_user to pause on a critical point, finish to stop. Coordinates are predicted directly from pixels, the same design choice Qwen-CUA makes for an entire desktop: skip the DOM and accessibility tree, and bet that whatever a human can operate with a screen and two input devices is a general enough interface. Fara1.5 just makes that bet at a fraction of the parameter count, and only for the browser.
The safety mechanism is worth naming precisely because it's a real constraint, not a suggestion: the model is trained to trigger ask_user at eight defined "critical point" types -- across three dimensions (permission granted or not, task fully specified or not, action reversible or not) -- covering things like entering personal information, submitting payment or shipping details, or sending a message on the user's behalf. Microsoft's recommended deployment wrapper, MagenticLite, is sandboxed and pausable specifically so a human is in the loop at those points. ask_user and memorize are context-management tools in exactly Lilian Weng's sense from Agent harnesses -- deciding what to carry forward and when to hand control back -- just built into the action vocabulary itself rather than the surrounding scaffold.
Trained on trajectories it generated for itself
Nearly all of Fara1.5's training data comes from FaraGen1.5, its own synthetic-data pipeline. A solver -- GPT-5.4, paired with a user simulator that withholds task details the way a real user would -- attempts tasks in two kinds of environments: the live, open web, and six sandboxed synthetic apps (Mail, Calendar, Stream, ML, Stay, Scheduler) whose functional code was itself generated by a coding agent (GitHub Copilot CLI) rather than scraped or mocked. Every resulting trajectory then has to clear three independent verifiers before it counts as training data.
Did the trajectory pause and ask before an irreversible action -- payment, submit, send -- or did it barrel through one no user ever authorized.
Almost none of this is human-collected. The solver is GPT-5.4 (a strong but not vision-only agent, 83% on Online-Mind2Web) paired with a simulated user that withholds task details the way a real one would. Three verifiers gate the output before it counts as training data -- reject on any one and the trajectory never reaches the mix below. 60% of the final set is still ordinary web trajectories; the rest is synthetic environments, form-filling with deliberate ambiguity, grounding, and a small slice of VQA and drag gestures.
That data becomes roughly 2 million training samples, 60% still ordinary open-web trajectories, the rest split across synthetic environments, deliberately ambiguous form-filling, grounding, and a small slice of VQA and drag gestures. It's a real answer to the standard complaint about computer-use training data -- human demonstrations are slow and expensive to collect -- but it's worth being precise about what "generated" means here: the solver, the user simulator, and the verifiers are themselves LLM judgments, not ground truth. A verifier checking "did this trajectory ask before an irreversible action" is exactly as reliable as the model doing the checking.
What the ladder buys
Fara1.5-27B reaches 72.3% on Online-Mind2Web, ahead of Gemini 2.5 Computer Use (57.3%), OpenAI Operator (58.3%), and Yutori Navigator n1 (64.7%) -- three proprietary systems, all evaluated on an independently maintained academic benchmark, not one Microsoft built. That's a genuine result: an open, MIT-licensed family beating closed competitors on a benchmark none of them control. But it only holds at the top of the ladder.
At 4B, Fara1.5 lands at 57.3% -- it exactly ties Gemini 2.5 Computer Use and trails both Operator and Navigator n1. At 9B it clears Gemini and Operator but still trails Navigator n1 by 1.3 points. Only at 27B does it clear all three -- by 15.0, 14.0, and 7.6 points. On WebVoyager the shape repeats: 89.3% at 27B, against Operator's 87.0%. The open, MIT-licensed family needs the full ladder to beat closed systems outright -- the smallest size is only competitive with the weakest one.
WebTailBench v1.5 -- Microsoft's own 609-task eval set, worth flagging as self-authored rather than independent -- shows the same monotonic climb, no crossover to check it against:
Read against the predecessor, Fara-7B, the jump looks even sharper: Fara1.5-9B improves +29.3 points on Online-Mind2Web, +13.1 on WebVoyager, +8.3 on WebTailBench, +18.1 on ScreenSpot-Pro grounding, +8.9 on OSWorld-G Refined. That comparison is real but not clean -- it conflates a parameter increase (7B to 9B) with a full training-pipeline change (FaraGen1.5 replacing whatever generated the original Fara's data). Stated as a training-pipeline improvement, it overclaims; stated as "the current generation beats the last one," it's exactly as strong as it sounds and no stronger.
Where the vision-only bet costs something
The model card is direct about the downsides of skipping the DOM: English-only, vulnerable to visual deception and prompt injection embedded in page content, error accumulation over long multi-step trajectories, and explicitly not suitable for legal, health, or financial use. None of that is unique to Fara1.5 -- Qwen-CUA's paper documents the same shape of limitation for the same underlying reason -- but a 4B vision-only model has less capacity to notice something is wrong mid-trajectory than a 397B-A17B one, and the model card doesn't pretend otherwise.
The take
Two orders of magnitude smaller than Qwen-CUA, scoped to a browser instead of a desktop, and shipping actual weights under MIT where Qwen-CUA ships code and a paper but withholds the checkpoints: Fara1.5 is a genuinely different point in the design space, not a smaller copy of the same idea. The headline -- 27B beats three proprietary computer-use agents on a benchmark none of them own -- is real. The more useful reading of the paper is the ladder underneath it: at 4B, Fara1.5 merely ties the weakest of those three baselines; the win only fully arrives at 27B. Vision-only browser control is not a capability a small model gets for free. It's bought, roughly a third of it per step up the ladder, exactly as parameter-scaling laws would predict.
Built on Microsoft Research's Fara1.5: Scalable Learning Environments for Computer Use Agents (Awadallah et al., 2026) and the microsoft/fara repository (MIT license). Figures 5 and 7 are reproduced from the paper for commentary, flattened onto white; the FaraGen1.5 pipeline diagram and scaling-vs-baseline chart are original illustrations of the paper's Figure 2 and Table 3 / Figure 7 data, not measured traces. Benchmark numbers are as reported in the paper.