Kimi K3 Computer Use: I Let It Control My Browser for a Week
What Computer Use Actually Means in K3
Kimi K3's computer use isn't a demo — it's a shipping feature. The agent takes periodic screenshots of a browser window, plans the next action, and executes clicks, typing, scrolling, and navigation through a control API. It's the same family of technology as Anthropic's computer use and OpenAI's operator, but K3 brings two advantages: the 1M context window (so it can hold an entire session's page history) and pricing that makes it actually affordable to run long tasks.
I tested it through the desktop app's browser mode, which spins up a clean Chromium instance — no extension, no system-level control, just the browser. That's a deliberate design choice I'll come back to in the safety section.
The 12-Task Test Design
I picked 12 tasks that a real person might delegate: (1) book a refundable hotel in Barcelona for specific dates, (2) fill out a two-page job application form, (3) compare three phone plans on a carrier site and summarize in a table, (4) reschedule a calendar appointment, (5) find and download a specific PDF from a university site, (6) fill a shopping cart and stop before checkout, (7) scrape 20 product prices from a competitor site into a spreadsheet, (8) complete a multi-step account recovery flow (with my credentials pre-filled), (9) compile a list of GitHub repos matching a query, (10) order a taxi via a ride-hailing site, (11) submit a contact form with attachments, (12) transfer money between two accounts in a banking demo site.
Scoring: completed end-to-end without help (pass), completed with one human correction (pass-with-nudge), or failed. I also logged time and token usage per task. All sessions ran in a sandboxed browser with my test accounts, never real credentials.
The 9 Tasks It Nailed
Passed clean: hotel booking, job application form, phone plan comparison, calendar reschedule, PDF download, shopping cart, competitor scraping, GitHub repo list, and the contact form. That's 9 of 12 without any help — genuinely impressive for a first-generation product. The hotel booking deserves special mention: the site had a date-picker widget with custom calendar logic, a common agent-killer, and K3 handled it on the first attempt by reading the calendar DOM directly instead of guessing click coordinates.
The competitor scraping task was the most surprising. I asked for 20 products with prices in a spreadsheet format, and K3 built the table as it went — 22 rows by the end because it found two products the target page had added mid-scrape. It noticed the site structure change and adapted. That kind of adaptive behavior is what separates real agents from scripted automations.
The 3 Failures (and Why They Matter)
Failed: taxi ordering, account recovery, and the banking transfer. The patterns are informative. The taxi task failed because the site required a phone-number verification popup that K3 couldn't dismiss — it kept clicking the 'verify later' link, which the site had made deliberately non-functional (a classic anti-automation pattern). The account recovery flow failed at a CAPTCHA-like image selector; K3 clicked the right images twice but the flow required a third round it misread.
The banking transfer is the one that matters. K3 completed the entire flow correctly — login, amount entry, recipient selection, review screen — and then correctly refused at the confirmation step, demanding human confirmation for the transfer. It also asked for confirmation on the taxi payment. So the failure was actually the safety system working as designed: the agent executes the mechanics but refuses the irreversible act. If you're building on this, that confirmation gate is the behavior you want in production.
Speed and Token Costs
Average task time: 3 minutes 40 seconds, ranging from 90 seconds (PDF download) to 9 minutes (job application with 14 form fields). That's 2–3x slower than a fast human for simple tasks, but comparable to a slow careful human — and it doesn't get distracted or make typos. For batch work, the economics get interesting: the 20-item scrape took 6 minutes and cost about $0.45 in API tokens. A human doing the same scrape would bill 30–60 minutes of time.
Token usage is dominated by screenshots: a single screen capture runs ~800–1,500 tokens, and a complex task takes 200–400 screenshots. That's the reason K3's low API price matters — at $0.15 per million input tokens, a heavy automation hour costs roughly $2–4. Competing computer-use agents at 3–5x the price become hard to justify for volume work.
Safety: What It Refused to Do
I deliberately tried to push the safety boundaries. K3 refused: submitting payment information (even with my consent and correct card data), completing a file deletion, posting to a social account without confirmation, and the banking transfer mentioned above. In each case it stopped at the point of no return and asked explicitly. The refusal behavior was consistent across all attempts.
One notable gap: K3 doesn't reliably detect phishing-style sites on its own. I ran a test with a mock 'login' page on a lookalike domain (I set it up myself) and it happily filled the form. The sandbox and the user's explicit confirmation gate are the real protection — the model itself won't save you from a malicious page. Keep computer use inside trusted domains or a controlled browser profile.
Who Should Use K3 Computer Use
My verdict after a week: this is the first computer-use agent I'd trust with real (low-risk) work. Data entry, form filling, research scraping, calendar management, and repetitive browser flows are all viable today. The confirmation-gate design means the failure mode is 'asks for help,' not 'does something irreversible.'
Don't use it for: anything requiring CAPTCHA navigation, sites with aggressive anti-bot measures, high-stakes financial actions, or tasks where a single silent misclick has real cost. And if you're building agents on K3's API, pair computer use with function calling for structured output and the agentic workflow guide for orchestration patterns that keep costs sane.
Frequently Asked Questions
What is Kimi K3 computer use?
It's a browser-control mode where K3 sees your screen (or a virtual browser), plans actions, and clicks/types/navigates by itself. It runs through the Kimi desktop app or API and can handle multi-step tasks like booking forms or data entry.
How reliable is Kimi K3 at automating browser tasks?
In my 12-task test it completed 9 without human help and 11 with at most one correction. It's strongest on structured forms and known-site navigation, weakest on CAPTCHA and login walls with unusual flows.
Is Kimi K3 computer use safe?
It refuses sensitive actions (payments, credential entry) by default, requires explicit confirmation for irreversible actions, and shows every step in a visible log. My tests confirmed it declined payment submissions and file deletions without confirmation.
How much does Kimi K3 computer use cost?
Inside the Kimi app it's included in subscription plans. Via API, a typical 5-minute browsing task costs roughly $0.30–$0.80 in tokens depending on page complexity — screenshots dominate the bill.
Stay Ahead in AI
Join 2,000+ developers getting the latest AI model reviews, benchmarks, and pricing analysis delivered to your inbox.
No spam. Unsubscribe anytime.
