We gave our operating layer hands. The first thing it did was stop.
The AI that runs FCT can see the screen and drive the Mac natively. On its first real job it hit a form tied to a security setting, refused to guess at a click, and handed the work back to a person.
You already ask AI to do things it can only describe. It tells you which setting to change, which button to click, which field to fill. Then you go do it yourself. The assistant lives in the chat window; the work lives on the screen, in the app, in the form — somewhere it can’t reach.
On July 9 we closed that gap for the operating layer we run FCT on. It gained a computer-use body: it captures the screen and sees it, reads the accessibility tree of whatever app is in front of it, and drives the Mac directly — cursor, keyboard, shortcuts, scroll. Not a description of the work. The work.
Its first real job came the same night. We were migrating FCT’s email automations off a personal login and onto a service account, which meant working through a Google admin console. It saw the console, read the native interface, and worked the screens alongside the setup — the multi-step click-here-then-there chore that had always been entirely manual.
Then it stopped.
The last two actions lived inside a browser form tied to a security grant, and a browser’s page contents aren’t exposed to the accessibility tree — only the frame around them is. It could have guessed at coordinates. On a security setting, a guess is a wrong click you find out about later. So it did the honest thing: it reported what it could and couldn’t see, and handed back two fifteen-second actions to a person.
That is the part worth announcing. Not the reach — the restraint.
The mechanism is deliberately plain and fully owned. Sight is a screen capture. Understanding is the macOS accessibility tree, the same structured view an app exposes to VoiceOver. Action is native system events through a small Swift helper we wrote ourselves, which also means the everyday mode moves no cursor at all: it presses and fills elements directly, so the machine stays usable while it works. Nothing rented, nothing installed from a vendor, no external service in the path.
The gap it stopped at is closed now. A browser channel runs under the same owned control layer we wrote about in July, where risk is assigned by the host rather than claimed by the tool, and anything that sends, posts or submits has to be confirmed by a person at the moment it happens. The LinkedIn version of this article went out through exactly that path, with a human approving every acting click. A month of real use later, the boundary is still the feature.
This is us running what we sell. The computer-use body isn’t a product on a shelf — Second Brain OS, the client form of this layer, is in testing and we’re not going to pretend otherwise. What we’ll say plainly is the standard behind it: capability and control boundary ship together, or the capability isn’t finished.
Software that can act on your behalf is only worth having if it knows which actions aren’t its to take. Anyone can build the reach. The judgment about where to stop is the part you should be buying.
Frequently asked questions
How does it actually see and act?
Three plain parts. Sight is a screen capture. Understanding is the macOS accessibility tree, the same structured view of an app that VoiceOver reads. Action is native system events through a small Swift helper we wrote. There is no third-party automation tool in the path and no cloud computer-use API — it runs on the machine, and the code is ours.
Does it take over the cursor while you're working?
Not by default. The everyday mode presses and fills elements through the accessibility API with zero cursor movement, so it can work while the Mac is in use. Moving the real pointer is a deliberate second mode, for a demo or for a target that exposes no accessibility action at all.
What stops it from clicking something it shouldn't?
Every action carries a risk level the host assigns, not the tool. Reading the screen runs freely. Anything that sends, posts, or submits requires a person to confirm at the moment of the click, and the confirmation is bound to that exact action. A tool cannot lower its own risk rating to get past the gate.
Can I buy this?
Not as a product on a shelf. It is part of the operating layer FCT runs itself on, and Second Brain OS — the client form of that layer — is in testing, not generally available. What transfers today is the discipline: when we build automation for a business, the capability and the control boundary ship together.