--- title: "UI-Mate-27B: the open-weight agent that clicks for you. With what permissions?" description: "Tencent’s UI-Mate-27B, open weights on Hugging Face, clicks and types on screen: licence, gating, context and permissions verified on 20 August." url: https://csidia.com/en/notes/ui-mate-27b-agente-pesi-aperti-permessi-desktop/ lang: en date: 2026-08-20 label: "Observatory" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/ui-mate-27b-agente-pesi-aperti-permessi-desktop/ --- # UI-Mate-27B: the open-weight agent that clicks for you. With what permissions? On 14 August the repository `tencent/UI-Mate-27B` appeared on Hugging Face: the `createdAt` field reads **2026-08-14T04:55:07Z**, last modified on 18 August. We verified it in person on 20 August, querying the public API and downloading files without authenticating. At that moment: **229 downloads**, **65 likes**, **22 files**, of which **12 `.safetensors` shards**. Declared tags: `computer-use-agent`, `gui-agent`, `desktop-agent`, `pyautogui`, `osworld`, `windowsagentarena`, `base_model:Qwen/Qwen3.6-27B`. This is not a chat model: it is an *agent* — it observes desktop screenshots and returns mouse and keyboard actions to complete a task on a real operating system, Windows or Ubuntu. ## Apache 2.0, the file lives elsewhere The card declares `license: apache-2.0`, confirmed both by the metadata (`cardData.license`) and by the README. On the Hugging Face repository we looked for the licence text under the names the platform normally uses — `LICENSE`, `LICENSE.md`, `LICENCE`, `NOTICE`, `USE_POLICY.md` — and all five return **HTTP 404**: the file is not there. It is the second case in two days: [yesterday the same pattern on an Ant Group model](https://csidia.com/en/notes/ling-3-0-tiny-licenza-dichiarata-file-assente), a licence declared in the tags and no document in the weights repository. The README, at the bottom, states verbatim: “UI-Mate is released under the Apache License 2.0. Third-party components remain subject to their respective licenses. See the repository LICENSE for details.” The link does not point to the repository we had just queried: it points to GitHub. There, the file exists — HTTP 200 — carrying the full text of Apache 2.0. That file adds a scoping clause worth quoting verbatim: “For the avoidance of doubt, UI Mate refers solely to the inference-enabling code, parameters, and weights made publicly available by Tencent in accordance with Apache-2.0.” — the desktop application and the rest of the project are not covered. It then lists two base models under the same licence — Qwen3.6-27B and Qwen3.5-9B, Apache 2.0, copyright Alibaba Cloud — and closes by restricting only itself: “UI Mate does not impose any additional restrictions beyond those specified in the original licenses of these third-party components.” We also checked the licence of the declared base model, Qwen/Qwen3.6-27B: it too is Apache 2.0, the chain does not diverge — unlike [other derivatives that change licence along the way](https://csidia.com/en/notes/derivati-pesi-licenza-cambia-strada). A second document narrowing use — a *usage policy* separate from the licence — does not exist: the README refers only to the “Intended Use and Limitations” and “Safety” sections, technical guidance, not a binding text. The `gated` field is `false`; verified by downloading `config.json` with no account: HTTP 200, full content, no login requested — consistent, [unlike repositories that declare an open licence behind a closed gate](https://csidia.com/en/notes/licenza-aperta-accesso-chiuso-modello-gated). ## The click is not in the weights From `config.json`: architecture `Qwen3_5ForConditionalGeneration`, 64 layers, hybrid attention — linear across most layers, full every fourth (`full_attention_interval: 4`) — plus its own vision encoder, consistent with a model that reads screenshots. The declared context is **262,144 tokens, i.e. 256K, not 262K**: it serves to hold dozens of steps of a long execution in memory, what the README calls *long-horizon execution across multiple applications*. The weights, from the `.safetensors` files, total **54,713,457,120 bytes** — around 54.7 GB, 50.9 GiB — for **27,356,728,560 parameters** in BF16. The README declares no minimum hardware: the only concrete reference is the sample command for vLLM, which uses `--tensor-parallel-size 2` — two GPUs, not one. At 54.7 GB for the weights alone, the model does not fit on a single 24 or 48 GB card without quantisation: our own calculation from file size, not a requirement stated by the vendor. There is also a distinction the README makes explicit: the checkpoint, on its own, produces structured text — a call such as `pyautogui.click(92, 302)` — not an actual click. Turning it into an on-screen action requires an external *harness*, published separately on GitHub, and a separate desktop application — also outside the weights repository — which the project describes like this: “Grant Permissions: Ensure accessibility and screen-recording permissions are granted so the agent can inspect UI elements and execute actions.” The weights alone do nothing: what is needed is the model, the harness that interprets its calls, and an operating system that grants — or denies — it access to the screen. It is the same logic, shifted from compute to control, behind [hardware and open-weight models](https://csidia.com/en/hardware-and-open-weight-models): weights you can download without the compute that makes them runnable are not sovereignty, and the same holds for permissions — weights you can download without whoever decides where they may click are not an agent under control. The README devotes a section to safety, written by the vendor itself: “Computer-use agents can make mistakes, encounter prompt injection, or trigger consequential actions.” Among the recommendations: “Require human confirmation before sensitive operations.” and “Do not treat a model-reported success as proof that the intended outcome was achieved.” Words that describe the risk we wrote about regarding [prompt injection that arrives by email](https://csidia.com/en/notes/prompt-injection-sicurezza-llm): here the attack channel is whatever appears on the screen the agent observes. For a company, a government, a defence ministry, the difference between a model that answers a question and a model that clicks on the screen is one of accountability, not speed. [An agent that can actually touch something](https://csidia.com/en/notes/agenti-ai-permessi-guardrail-responsabilita) requires written permissions, not a silent install. The register of models, for a checkpoint like this one, cannot stop at name and licence: it must also record the harness that runs it, the system permissions granted, who approved them, and which applications it may act on — the same discipline we ask for [the technical report a model card should provide before installation](https://csidia.com/en/notes/rapporto-tecnico-modello-cosa-dichiara). [See the service](https://csidia.com/en/solutions/ai-governance) · [Talk to an engineer](https://csidia.com/en/contact) ## What we don’t know We have not run UI-Mate-27B, we have not served the checkpoint with vLLM, and we have not verified the scores the card declares — 77.0 on OSWorld-Verified, 66.2 on WindowsAgentArena, 41.00 strict success on OSWorkerBench: figures from the card, not ours. OSWorkerBench, the benchmark Tencent uses to measure its own demo, has not yet published tasks, demonstrations or evaluators — the project’s table marks them *coming soon* — so today no one outside Tencent can reproduce those numbers. We do not know what minimum hardware is actually required: the vendor does not state it. We offer no legal classification: whether an agent clicking on a company’s desktop falls into a category under the AI Act depends on the actual use made of it — a judgement for whoever puts it into service, not for us. ## Sources - [Hugging Face — tencent/UI-Mate-27B, model card](https://huggingface.co/tencent/UI-Mate-27B) - [Hugging Face — model API (metadata, files, tags)](https://huggingface.co/api/models/tencent/UI-Mate-27B) - [GitHub — Tencent/UI-Mate, project LICENSE and README](https://github.com/Tencent/UI-Mate) - [arXiv 2608.15930 — UI-Mate: Advancing Open-Weight Foundation GUI Agents with In-Context Demonstrations](https://arxiv.org/abs/2608.15930) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/ui-mate-27b-agente-pesi-aperti-permessi-desktop/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com