GPT-5.4 Can Click Your Buttons Now. Think About That.
GPT-5.4 shipped with a 1M token context window and native computer use — browser automation, desktop control, and task execution built directly into the model. This is the first GPT model that can actually do things on your machine, not just talk about them.
The capability is genuine. Point it at a workflow and it can navigate your browser, fill forms, click buttons, and chain actions together. Reviewers noted the emphasis was on “efficiency over raw capability” — the model isn’t dramatically smarter than its predecessors, it’s dramatically more connected to the systems around it.
Sound familiar? That’s the integration thesis playing out at the model level.
The interesting shift isn’t that GPT-5.4 scores higher on benchmarks. It’s that OpenAI chose to invest in connecting the model to real-world actions rather than just making it think better. After years of the AI race being defined by reasoning benchmarks, the competitive frontier just moved to execution.
But here’s where it gets uncomfortable. An AI that can click buttons and fill forms is also an AI that can be manipulated into clicking buttons and filling forms.
Every prompt injection attack just got more dangerous. Previously, a compromised AI assistant might leak data or generate misleading text. An AI with computer use can:
- Submit forms with attacker-controlled data
- Navigate to malicious URLs in your authenticated browser session
- Execute multi-step workflows that individually look benign but chain into something harmful
- Interact with your desktop in ways that bypass traditional security controls
The attack surface isn’t theoretical. We’ve already seen prompt injection exfiltrate data through AI assistants with email access. Give that same vulnerability class a mouse and keyboard, and the blast radius expands dramatically.
If you’re evaluating GPT-5.4’s computer use capabilities:
- Sandbox ruthlessly. Computer use in a production environment without isolation is an incident waiting to happen.
- Audit every action chain. Don’t just review what the model was asked to do. Review what it actually did.
- Assume adversarial input. Every webpage, email, and document the model processes while it has computer control is a potential injection vector.
The model that can do your work for you is the same model that can be tricked into doing someone else’s work on your machine. How are you planning to tell the difference?