UI-TARS Desktop (ByteDance, open-source app)
- Category
- Computer-use agent
- Type
- Open-source (Apache-2.0) desktop app (Electron) and Agent TARS CLI/Web UI from ByteDance; free; runs with UI-TARS or Seed models chosen by the user
- Scope
- The UI-TARS Desktop app and Agent TARS from the same repository, v0.2.x to v0.3.1 (8 Oct 2026). The UI-TARS models on their own are not covered; model-only results are context.
- Source
- Project repository
- Last reviewed
- 2026-10-19 (what this means)
Summary
UI-TARS Desktop is a free, open-source app from ByteDance that lets an AI model operate a computer or browser by looking at the screen and using the mouse and keyboard. Most published results test ByteDance's UI-TARS models rather than this app, or come from ByteDance itself, and are not counted. The one independent test of the app found (Ohio State, preprint, Feb 2026) triggered a timing weakness in all 14 cases tried: a page that changed between when the agent looked and when it clicked led it to click the wrong thing, as with other screenshot-based agents. CVE-2026-81735 (CVSS 10.0, VulnCheck) concerned companion tool servers that accepted unauthenticated connections from the network; v0.3.1 changed the default to local-only. Insufficient evidence for an overall score. Informational only; not a guarantee, endorsement, or certification.
Status: Insufficient evidence — no overall score is given (fewer than three independent performance sources). Independent performance sources: 1.
Factor notes (no scores)
| Factor | Weight | Score | Note |
|---|---|---|---|
| Completion rate | 30% | — | No independent task-completion results for the app. Vendor model figures (not counted): UI-TARS-1.5 OSWorld 42.5, WindowsAgentArena 42.1; UI-TARS-2 OSWorld 47.5, AndroidWorld 73.3, Online-Mind2Web 88.2. Not scored. |
| Disputes | 20% | — | No legal or regulatory action found. CVE-2026-81735: MCP command and filesystem servers in the @agent-infra packages bound all network interfaces without authentication, allowing remote command execution. CVSS 10.0 (VulnCheck); NVD status Deferred. Default changed to localhost in v0.3.1 (commit c2ad42e); no authentication added to those servers. Not scored. |
| Adherence to limits | 25% | — | TOCTOU study (Ohio State, preprint): vulnerability triggered in 14/14 cases (version and model not stated). Model-only safety tests of UI-TARS-1.5 (CUAHarm: 42.3% of harmful tasks completed; GhostEI-Bench; AgentHijack) and of the UI-TARS 7B model (VPI-Bench: attempted injected malicious tasks in 70-79% of cases but completed none) are context, not counted. The MIT AI Agent Index found no published safety framework or third-party testing. Not scored. |
| Evidence quality | 25% | — | One counted independent source; below the three-source minimum. Not scored. |
See the methodology for the insufficient-evidence rule.
Scope and version note
This entry covers the UI-TARS Desktop app and Agent TARS (command line and web interface), which ship from the same repository and releases, from v0.2.x to v0.3.1 (8 October 2026). The UI-TARS models are not covered on their own: studies that tested only the model, not the app, are listed as context and not counted. The one counted study does not state the app version or model used.
Affiliation disclosure
UI-TARS Desktop is developed by ByteDance. Results from ByteDance and ByteDance Seed papers are not counted. No listed independent study has ByteDance authors.
Security
An independent study (Ohio State, preprint, February 2026) found that UI-TARS Desktop, like the other screenshot-based agents tested, could be led to act on a page that changed between observation and action in all 14 cases tried. CVE-2026-81735: MCP command and filesystem servers in the @agent-infra packages bound all network interfaces without authentication, allowing remote command execution. CVSS 10.0 (VulnCheck); NVD status Deferred. Default changed to localhost in v0.3.1; no authentication added to those servers. No lawsuits or regulatory actions were found.
Uncertainties
- Full-text search coverage is incomplete; Semantic Scholar was rate limited on 17 and 19 October 2026.
- The one counted study does not state the app version or model.
- The CVE concerns MCP servers shipped with Agent TARS, not the Electron GUI itself.
Sources
Independent performance sources (counted)
- Atomicity for Agents (Ohio State, preprint Feb 2026): 10 agents tested on 9 synthesized and 5 real-world cases; UI-TARS-desktop vulnerable in all 14 cases. Security test, not task completion — accessed 2026-10-17
Other sources (not counted)
- MIT 2025 AI Agent Index (FAccT 2026): documents features; lists no safety framework, third-party testing or risk evaluations found — accessed 2026-10-17
- CVE-2026-81735 (GHSA-p68p-fq8j-3639): unauthenticated MCP servers bound to all interfaces; default changed to localhost in v0.3.1 — accessed 2026-10-17
- Agentic Botnets (Tel Aviv, Technion, Intuit): language models invent GitHub names when asked to install ui-tars-desktop; top five invented names catch 84%. Supply-chain risk; not a test of the app — accessed 2026-10-17
- LexBench-Browser supports Agent TARS; no result published — accessed 2026-10-17
Vendor statements and model-only tests (not counted)
- UI-TARS-2 technical report (ByteDance Seed) — accessed 2026-10-17
- UI-TARS paper (ByteDance) — accessed 2026-10-17
- CUAHarm: UI-TARS-1.5 model, not the app — accessed 2026-10-17
- GhostEI-Bench (ICLR 2026): UI-TARS-1.5-7B model, not the app — accessed 2026-10-17
- AgentHijack: UI-TARS model, not the app — accessed 2026-10-17
- VPI-Bench (ICLR 2026; National University of Singapore): UI-TARS 7B model, not the app; attempted injected malicious tasks in 78.95% (Amazon) and 70% (Messenger) of cases, with 0% attack success because it could not complete the steps — accessed 2026-10-19
Checked with no test of the app found: nanoMuse, Code as Agent Harness, AgentSWE, Malva, RedTeamCUA. A GitHub issue offering a paid audit report (#1854) was not treated as evidence.