UI-Mate-27B: the open-weight agent that clicks for you. With what permissions?
7 min read
On 14 August the repository tencent/UI-Mate-27B appeared on Hugging Face: the createdAt field reads 2026-08-14T04:55:07Z, last modified on 18 August. We verified it in person on 20 August, querying the public API and downloading files without authenticating. At that moment: 229 downloads, 65 likes, 22 files, of which 12 .safetensors shards. Declared tags: computer-use-agent, gui-agent, desktop-agent, pyautogui, osworld, windowsagentarena, base_model:Qwen/Qwen3.6-27B. This is not a chat model: it is an agent — it observes desktop screenshots and returns mouse and keyboard actions to complete a task on a real operating system, Windows or Ubuntu.
Apache 2.0, the file lives elsewhere
The card declares license: apache-2.0, confirmed both by the metadata (cardData.license) and by the README. On the Hugging Face repository we looked for the licence text under the names the platform normally uses — LICENSE, LICENSE.md, LICENCE, NOTICE, USE_POLICY.md — and all five return HTTP 404: the file is not there. It is the second case in two days: yesterday the same pattern on an Ant Group model, a licence declared in the tags and no document in the weights repository. The README, at the bottom, states verbatim: “UI-Mate is released under the Apache License 2.0. Third-party components remain subject to their respective licenses. See the repository LICENSE for details.” The link does not point to the repository we had just queried: it points to GitHub. There, the file exists — HTTP 200 — carrying the full text of Apache 2.0.
That file adds a scoping clause worth quoting verbatim: “For the avoidance of doubt, UI Mate refers solely to the inference-enabling code, parameters, and weights made publicly available by Tencent in accordance with Apache-2.0.” — the desktop application and the rest of the project are not covered. It then lists two base models under the same licence — Qwen3.6-27B and Qwen3.5-9B, Apache 2.0, copyright Alibaba Cloud — and closes by restricting only itself: “UI Mate does not impose any additional restrictions beyond those specified in the original licenses of these third-party components.” We also checked the licence of the declared base model, Qwen/Qwen3.6-27B: it too is Apache 2.0, the chain does not diverge — unlike other derivatives that change licence along the way.
A second document narrowing use — a usage policy separate from the licence — does not exist: the README refers only to the “Intended Use and Limitations” and “Safety” sections, technical guidance, not a binding text. The gated field is false; verified by downloading config.json with no account: HTTP 200, full content, no login requested — consistent, unlike repositories that declare an open licence behind a closed gate.
The click is not in the weights
From config.json: architecture Qwen3_5ForConditionalGeneration, 64 layers, hybrid attention — linear across most layers, full every fourth (full_attention_interval: 4) — plus its own vision encoder, consistent with a model that reads screenshots. The declared context is 262,144 tokens, i.e. 256K, not 262K: it serves to hold dozens of steps of a long execution in memory, what the README calls long-horizon execution across multiple applications. The weights, from the .safetensors files, total 54,713,457,120 bytes — around 54.7 GB, 50.9 GiB — for 27,356,728,560 parameters in BF16. The README declares no minimum hardware: the only concrete reference is the sample command for vLLM, which uses --tensor-parallel-size 2 — two GPUs, not one. At 54.7 GB for the weights alone, the model does not fit on a single 24 or 48 GB card without quantisation: our own calculation from file size, not a requirement stated by the vendor.
There is also a distinction the README makes explicit: the checkpoint, on its own, produces structured text — a call such as pyautogui.click(92, 302) — not an actual click. Turning it into an on-screen action requires an external harness, published separately on GitHub, and a separate desktop application — also outside the weights repository — which the project describes like this: “Grant Permissions: Ensure accessibility and screen-recording permissions are granted so the agent can inspect UI elements and execute actions.” The weights alone do nothing: what is needed is the model, the harness that interprets its calls, and an operating system that grants — or denies — it access to the screen. It is the same logic, shifted from compute to control, behind hardware and open-weight models: weights you can download without the compute that makes them runnable are not sovereignty, and the same holds for permissions — weights you can download without whoever decides where they may click are not an agent under control.
The README devotes a section to safety, written by the vendor itself: “Computer-use agents can make mistakes, encounter prompt injection, or trigger consequential actions.” Among the recommendations: “Require human confirmation before sensitive operations.” and “Do not treat a model-reported success as proof that the intended outcome was achieved.” Words that describe the risk we wrote about regarding prompt injection that arrives by email: here the attack channel is whatever appears on the screen the agent observes.
For a company, a government, a defence ministry, the difference between a model that answers a question and a model that clicks on the screen is one of accountability, not speed. An agent that can actually touch something requires written permissions, not a silent install. The register of models, for a checkpoint like this one, cannot stop at name and licence: it must also record the harness that runs it, the system permissions granted, who approved them, and which applications it may act on — the same discipline we ask for the technical report a model card should provide before installation.
See the service · Talk to an engineer
What we don’t know
We have not run UI-Mate-27B, we have not served the checkpoint with vLLM, and we have not verified the scores the card declares — 77.0 on OSWorld-Verified, 66.2 on WindowsAgentArena, 41.00 strict success on OSWorkerBench: figures from the card, not ours. OSWorkerBench, the benchmark Tencent uses to measure its own demo, has not yet published tasks, demonstrations or evaluators — the project’s table marks them coming soon — so today no one outside Tencent can reproduce those numbers. We do not know what minimum hardware is actually required: the vendor does not state it. We offer no legal classification: whether an agent clicking on a company’s desktop falls into a category under the AI Act depends on the actual use made of it — a judgement for whoever puts it into service, not for us.
How we solve this
Comply: the register of models in production becomes a control that runs on the client’s own systems — for an agent like this, a line with version and licence is not enough: it must record the harness that runs it, the system permissions granted (accessibility, screen), the applications it may act on, and who signed off that authorisation — with the dated trail ready to show an inspector, a client in a tender, or a board.
Decide: the same system holds models, data, contracts, archives and documents together in a single operating model, on which AI agents execute decisions with a human operator in command, for large enterprises, defence, government and healthcare. An agent that clicks unattended on a system touching real data or processes remains, in every case, an agent whose sensitive actions an operator approves — not a process running unwatched. Always in the two delivery modes — on-premise, on self-contained machines that require no deep integration into the client’s network, or dedicated cloud with a dedicated VPN and a data centre in Italy — and always with shared governance: you need not already have, in house, someone who administers these systems.
From the first session, at no cost, comes the dated register of the agents in operation: for each one, what permissions it holds, who granted them, and what you have verified — including the boxes left blank. It stays with you even if we do not carry on together.