Qwen3.8-27B: self-hosted computer-use agents that keep screenshots in house

Qwen3.8-27B is the first open-weight model whose published desktop-operation score beats the hosted frontier models in its own comparison table. That matters commercially for one reason: screen automation is the workload where sending data to someone else's API is hardest to defend. A screenshot carries whatever happened to be on the screen, including the customer record next to the invoice you wanted read.

This article answers a narrow buying question: can a self-hosted screen agent now do useful back-office work, and what has to be true before it touches a production system? It is not a hardware sizing guide. For memory envelopes, quantization trade-offs and single-workstation pilots, use our local agent model hardware and benchmark guide. If you would rather buy a hosted computer-use product than run one, read our review of a research-preview computer-use agent. Keeping those three intents on separate pages is deliberate.

What Qwen3.8-27B actually is

Alibaba's Qwen team published the weights on 14 August 2026. The official Qwen3.8-27B model card is the primary source for this section and for the benchmark table below.

The number that changes the build-versus-buy call

OSWorld-Verified measures whether an agent finishes real tasks in a real desktop environment: open the file, change the setting, complete the form. It is the closest public proxy for the back-office work companies actually want automated. Qwen's published table puts a model you can run yourself ahead of the hosted models it lists.

Read the WebArena row before the OSWorld row. A score of 64.8 on browser tasks means roughly one in three attempts fails on the surface where most commercial automation lives. The desktop result is genuinely strong. It is not a licence to point an agent at your ERP and leave the room.

Why one vendor's table cannot settle a model choice

Two vendors published different numbers for the same third-party model on the same benchmark within days of each other. Qwen reports 63.9 for its own previous generation, Qwen3.6-27B, on OSWorld-Verified. Meta's launch table for its 30B local model reports 75.6 for that same Qwen generation, as covered in our Muse Glimmer guide.

Neither number has to be wrong. Computer-use results depend on the scaffold: how many steps the agent may take, what screenshot resolution it sees, whether an accessibility tree is available, how tool errors are retried, which system prompt drives it. That is also why a vendor table cannot predict your result. The harness is part of the measurement, and in your deployment the harness is yours.

Our rule: use published tables to decide what deserves a test, never to decide what ships. Freeze your own scaffold and measure again. The same discipline applies to money, which we model in cost per token versus cost per accepted task.

Screenshots are the payload you least want to export

Text prompts can be filtered. A screen agent's input cannot be, in any complete sense. It sees the window it was told to operate plus everything around it: the neighbouring record, the open ticket, the internal dashboard, a colleague's name in a notification. Redaction before the call, the approach in removing personal data before it reaches an LLM, works on structured text. It does not survive contact with arbitrary pixels.

That is why an open-weight model with credible desktop scores is a different proposition from a slightly better hosted one. Running inference inside your own network removes the transfer, the vendor retention question and one more sub-processor entry. It does not remove your obligations as the operator, and it adds the work of running the stack yourself. If the transfer is what blocks your risk assessment, this release removes the blocker. If the real blocker is that nobody on the team wants to operate GPUs, self-hosting does not help you.

What the hybrid attention stack changes for your serving plan

Capacity planning for a dense transformer does not carry over. Three quarters of the layers here are Gated DeltaNet layers, which hold a fixed-size recurrent state instead of a key-value cache that grows with every token. Long context therefore stops being a single linear memory curve, and estimates you memorised for a 27B transformer will mislead you in both directions.

The SGLang deployment cookbook for this model shows the consequence directly: the hybrid state cache gets its own sizing flags, including --mamba-full-memory-ratio and --max-mamba-cache-size, and the cookbook lists BF16, FP8 and NVFP4 W4A4 checkpoints with in-checkpoint multi-token prediction, targeting single-GPU serving on H200, RTX PRO 6000, RTX 5090 and DGX Spark class hardware.

Four planning consequences follow, and each one is a measurement rather than a formula:

• Preallocation is a budget decision. The state cache is reserved up front. Free memory at idle tells you very little about behaviour at your real concurrency.
• Screenshots are expensive tokens. Image tokens dominate a GUI trace. Measure at the resolution and step count your agent will really use, not with a text prompt.
• Speculative decoding must be validated, not assumed. Multi-token prediction helps single-stream latency most and can be close to neutral under heavy batching.
• Quantization is a quality experiment. W4A4 changes what fits on one card. Whether it changes task success on your screens is a question only your own fixtures answer.

If you are deciding how to serve this next to existing models, the platform patterns in an inference stack built on vLLM and Triton and the total-cost model in self-hosting LLMs in the EU apply unchanged.

Where a self-hosted screen agent still loses

The honest failure modes are not about capability. They are about what happens when the screen is adversarial or the action is irreversible.

Screen agents read rendered pixels, so they cannot reliably tell a genuine interface element from user-generated content that merely looks like one. The VPI-Bench study of visual prompt injection reports that across 306 test cases on five widely used platforms, computer-use agents were deceived at rates of up to 51 percent and browser-use agents up to 100 percent on certain platforms, and that system-prompt defences produced only limited improvement. A comment field, a calendar invite title or a PDF footer is an instruction channel.

Before any agent gets credentials, put it through the controls in our AI agent evaluation and sandbox checklist. The structural rule is short: an agent that combines access to private data, exposure to untrusted content and a way to send data outward is exploitable. Break one of the three.

A two-week evaluation that ends in a decision

1. Pick one process and 20 to 30 real tasks. Use last month's actual queue, including the messy cases and the ones a human escalated.
2. Build fixture environments, not live systems. Snapshot the application state so a run is repeatable and a failure is diagnosable.
3. Freeze the scaffold. Record checkpoint and quantization, runtime version, step limit, screenshot resolution, accessibility inputs, system prompt, tool set and retry policy.
4. Measure accepted outcomes, not demos. Track task completion, silent wrong actions, human correction minutes and steps per task.
5. Measure the serving envelope. Capture peak memory at target concurrency, prefill latency with image-heavy prompts, output speed and degradation under parallel sessions.
6. Attack it on purpose. Plant injected instructions in the fields your users can edit, then verify the agent refuses and logs the attempt.
7. Compare against the boring baseline. Run a deterministic script or an existing API on the same tasks. Sometimes the agent loses, and that is a useful result.
8. Price the accepted task. Include GPU capacity, engineering, monitoring, review time and failed runs, then compare with today's manual cost.

A pass is not "the model ran". A pass is a completion rate above your process threshold, no silent destructive action in the adversarial set, a serving envelope that holds at real concurrency, and a cost per accepted task that beats the status quo.

The compliance work self-hosting does not remove

Keeping inference in house shortens the data-protection conversation. It does not end the AI Act conversation. According to the European Commission's transparency guidance for Article 50, those obligations apply from 2 August 2026, with a limited grace period until 2 December 2026 for the marking and detection duty covering systems already on the market before that date. Deployer duties are real but specific: informing people exposed to emotion recognition or biometric categorisation systems, and labelling deepfakes and AI-generated text on matters of public interest published without human editorial review.

Two practical points for a screen agent. First, an internal back-office automation is often not an Article 50 system at all, so document the reasoning rather than assuming either answer. Second, substantially modifying an open-weight model can move you along the value chain toward provider duties, which is a question to settle with counsel before you fine-tune, not after. Our Article 50 engineering checklist covers the implementation side, and our trust center states plainly what we do and do not certify. This is operational guidance, not legal advice.