Desktop AI agent software is where rabbit has ended up, two and a half years after it sold an orange handheld device on the premise that an assistant needed its own hardware to exist. OS3, generally available from 22 September 2026, runs in the cloud and drives Windows, Mac and Linux machines you already own. The r1 is still supported. It is no longer required, and it is no longer being made.
That reversal is the story, and it is bigger than one company. The dedicated AI gadget was the defining hardware idea of 2024, and by late 2026 almost every serious version of it has either shut down or turned into software that runs on the computers people already have. A desktop AI agent asks for nothing new in your pocket, which removes the single hardest thing about selling the category.
This article covers what rabbit actually shipped, the engagement numbers that explain the pivot, what the published benchmark evidence says about whether a desktop AI agent can complete long real-world tasks yet, how bring-your-own-key changes the economics, and the security question that arrives the moment one account can drive five machines. The product is interesting. The reliability data is the part worth reading twice.
Table of contents
- What Rabbit Actually Shipped on 22 September
- The Desktop AI Agent Replaces the Gadget
- What a Desktop AI Agent Has to Get Right
- Desktop AI Agent Reliability: The Benchmark Evidence
- Bring Your Own Key Changes Desktop AI Agent Economics
- Five Machines, One Desktop AI Agent: The Security Question
- Who a Desktop AI Agent Is Actually For Today
- How a Desktop AI Agent Differs From an Assistant You Already Use
- What Would Make the Desktop AI Agent Category Work
- Frequently Asked Questions About Rabbit OS3
- References
What Rabbit Actually Shipped on 22 September
OS3 is described by rabbit as an agentic operating system, which is marketing language for something reasonably specific.
One desktop AI agent conversation across many machines
The product is a unified chat interface that reasons through tasks using connected models, web services and devices. A single account can connect up to five devices, and the conversation, identity, memory and skills persist across all of them rather than starting fresh per machine.
It runs where you already work
Supported targets are local Windows, Mac and Linux PCs, cloud virtual machines, dedicated AI machines and the r1 itself, with more device types promised. The cloud does the reasoning; the local machine does the acting. That division is what makes a desktop AI agent possible without a purpose-built box, and it is why a desktop AI agent needs no silicon of its own.
You reach it from wherever you are
Access is through a web portal on desktop and mobile, a paired Telegram account, iMessage, RCS or SMS, or the r1. Text-messaging your own computer is an unusual interface choice and a genuinely practical one, because it works on any phone without an install.
The founder’s framing
Jesse Lyu, rabbit’s founder and chief executive, described the goal as “a system you don’t operate, but instead just tell it the outcome”. That is the standard agentic pitch, but it is a fair description of what changes when a desktop AI agent controls a real machine rather than a curated set of integrations.
The Desktop AI Agent Replaces the Gadget
Rabbit is not making the r1 any more and has no R2 planned. A vibe-coding cyberdeck is promised within months, and it will ship with OS3 as its default operating system — hardware as an accessory to the software rather than the other way round.
The category’s short, expensive history
Humane raised roughly $240 million to build the AI Pin, a wearable intended to replace the smartphone. HP acquired its assets for $116 million in February 2025, including more than 300 patents and most of the staff, and the Pin’s servers were switched off at 3pm Eastern on 28 February 2025. The founders joined an HP team called HP IQ.
Rabbit’s own numbers were not much kinder
The r1 sold around 130,000 units in the months after its CES 2024 launch. By September 2024, with roughly 100,000 purchasers, the company reported about 5,000 daily active users. That is a 5 per cent daily engagement rate on a device people had already paid for.
What the gadget was really charging for
A dedicated device asked the buyer to carry a second object, learn a new interaction model, accept slower responses than their phone, and pay both for hardware and for a subscription. A desktop AI agent removes the first three of those costs outright and, in rabbit’s case, the fourth as well. Nothing about a desktop AI agent requires the buyer to change what they carry.
The remaining argument for hardware
There is still a real case for a purpose-built device: always-on sensing, a dedicated microphone array, and a form factor that does not compete with the phone for attention. The cyberdeck is rabbit’s bet on that case. But it is now a bet placed on top of working software, not underneath it.
| Product | Model | Outcome | Asks the user to |
|---|---|---|---|
| Humane AI Pin | Device plus subscription | Assets sold to HP, Feb 2025 | Wear a second device |
| rabbit r1 | Device, no subscription | Discontinued, no R2 | Carry a second device |
| rabbit OS3 | Software, bring your own key | Shipped 22 Sept 2026 | Install on machines they own |
| rabbit cyberdeck | Device running OS3 | Promised within months | Buy hardware for software that works |
What a Desktop AI Agent Has to Get Right
Controlling a real operating system is a much harder problem than calling an API, and it fails in characteristic ways.
Seeing the screen
An agent driving a desktop has to interpret pixels, window chrome and application state it has never seen. This is a computer vision problem before it is a reasoning problem, and unfamiliar interfaces remain one of the most common sources of failure.
Keeping a desktop AI agent on task for hours
Real work is long. A desktop AI agent that loses track of a decision it made ninety steps ago will produce output that looks complete and is subtly wrong, which is worse than stopping.
Knowing when to ask
The hardest judgement for a desktop AI agent is recognising that the instruction was ambiguous. Agents consistently prefer to guess and continue rather than pause and clarify, because continuing looks like progress.
Checking its own work
Verification is the step agents skip most. A desktop AI agent that submits unfinished work without backtracking to confirm earlier steps is exhibiting a documented, repeated failure pattern rather than an occasional slip.
Desktop AI Agent Reliability: The Benchmark Evidence
There is now a published benchmark built specifically for this, and its results are sobering.
What OSWorld 2.0 measures
OSWorld 2.0 evaluates computer-use agents on 108 long-horizon workflows across 31 self-hosted websites and professional applications. Tasks average more than 300 agent steps, against roughly 30 in the original OSWorld, and carry an average of 27 scoring checkpoints each.
These are genuinely hard tasks
Snorkel AI, which publishes the benchmark analysis, reports that 69.6 per cent of the tasks would take a skilled human more than an hour, with a median human time estimate of about 1.5 hours per task. This is not a suite of one-click errands.
The scores
In that harness, Claude Opus 4.8 completed 20.6 per cent of tasks outright and scored 54.8 per cent with partial credit. Claude Fable 5.1, released during the analysis, passed 45 per cent outright and over 60 per cent on partial credit. GPT models scored lower on accuracy while using fewer tokens.
Beware comparing across harnesses
Anthropic’s own materials for Claude Opus 5.5 report an OSWorld 2.0 figure of 81.8 per cent, against 80.7 for Fable 5.1 and 74.0 for Opus 5. Those numbers are not comparable with the ones above: they reflect a different scoring configuration and scaffold. The lesson is not that one party is wrong, it is that a computer-use score is meaningless without its harness.
The four failure modes
Snorkel AI’s analysis groups the failures into missing information, perception, verification and memory. Every one of them gets worse as trajectories lengthen, which is precisely the direction a desktop AI agent product is pushing. None of the four is specific to rabbit; they are properties of the category.
| Failure mode | What it looks like | Practical guard |
|---|---|---|
| Information missing | Guesses instead of asking | Over-specify the task up front |
| Perception | Misreads unfamiliar interfaces | Stick to mainstream applications |
| Verification | Submits unfinished work | Define a checkable end state |
| Memory | Forgets early decisions | Break long jobs into short runs |
Bring Your Own Key Changes Desktop AI Agent Economics
The pricing model is the second genuine departure from the r1 era, and it is more consequential than it sounds.
You supply the intelligence
OS3 runs on API keys you provide, whether from a frontier lab, a cloud router platform, or a model hosted on your own hardware. Rabbit supplies the desktop AI agent orchestration, the memory and the device control; you supply and pay for the reasoning.
Models are swappable without losing state
Rabbit says models can be swapped without affecting context, memory or skills. If that holds in practice it is the most defensible thing about the product, because it makes the agent layer durable while the model layer churns every few months.
Why this is good for the buyer
You are never locked into a model whose price or quality moves against you, and a price cut at any lab flows straight through to your running costs. Given how fast list prices have fallen this year, that optionality is worth something real.
Why it is harder for rabbit
A vendor that does not sell tokens cannot subsidise anything with them, and it cannot hide a margin in them either. The revenue has to come from the software, the forthcoming hardware, or nowhere — which is a demanding position for a company whose previous product sold 130,000 units and retained 5 per cent of them.
Five Machines, One Desktop AI Agent: The Security Question
This is the part that deserves more attention than it is getting.
What the permission actually is
Connecting a machine to OS3 grants a desktop AI agent running as a cloud service the ability to act on that machine as you. Multiply by five devices on one account, and a single compromised credential reaches every one of them. That is a different risk shape from a phone app with scoped permissions.
Prompt injection is the live threat
An agent that reads web pages and documents will eventually read instructions written for it by someone else. This is the central unsolved problem in computer-use agents, and it does not require any flaw in rabbit’s code to bite — the attack targets the model’s willingness to follow text it encounters.
Messaging access widens the surface
Reaching your agent over SMS, RCS or iMessage is convenient and means the control channel is only as strong as your phone number. Any organisation deploying autonomous AI agents on managed endpoints should be clear about which channels can issue instructions and which cannot.
A sensible desktop AI agent starting posture
Run a desktop AI agent on a machine that is not your primary one, with credentials it cannot use to reach anything important, and with a clear answer to what it is allowed to buy, send or delete. Treating it as an unattended contractor rather than a feature is the right mental model, and it is where managed IT services thinking transfers directly.
Who a Desktop AI Agent Is Actually For Today
Given the reliability data, the honest audience is narrower than the marketing.
Good fit: long, tedious, checkable work
A desktop AI agent earns its keep where the end state can be verified cheaply — a file is in the right format, a spreadsheet balances, a batch of records was created — are where an agent’s inability to self-verify matters least, because you can verify for it.
Good fit: people who already run multiple machines
The five-device model is genuinely useful if you have a laptop, a desktop and a cloud VM and currently context-switch between them. One desktop AI agent thread across all three is a real improvement.
Poor fit: anything irreversible
Payments, deletions, outbound communication and anything touching production should not be delegated to a desktop AI agent with a documented tendency to submit unfinished work without checking it.
Poor fit: obscure software
Perception failures cluster on unfamiliar interfaces. A desktop AI agent driving mainstream applications is on much firmer ground than one driving a bespoke line-of-business tool nobody has trained against.
How a Desktop AI Agent Differs From an Assistant You Already Use
The word “agent” is doing a lot of work in this market, and the distinction that matters is what the software is allowed to touch.
A chatbot answers, a desktop AI agent acts
A conversational assistant returns text and leaves the doing to you. A desktop AI agent opens applications, clicks, types and saves files on a real machine. The capability gap between those two is smaller than the risk gap.
Integrations are narrow, desktop control is not
An assistant wired into a calendar and an email account can do exactly what those two APIs permit. A desktop AI agent inherits whatever your logged-in session can reach, which is usually everything, and no API designer scoped that permission.
Persistent memory changes the failure mode
Because OS3 carries one continuous thread with memory across all five connected devices, a misunderstanding acquired on Monday can still be shaping behaviour on Thursday. Statelessness was an accidental safety feature, and a desktop AI agent gives it up deliberately.
The interface is the operating system
Rabbit’s framing of OS3 as an agentic operating system is more honest than most. Once software drives the whole desktop, it is closer to a shell than to an application, and it should be evaluated with the scepticism you would apply to a shell.
| Property | Chat assistant | API-integrated assistant | Desktop AI agent |
|---|---|---|---|
| Reach | Its own window | Connected services | Whatever you can reach |
| Permission model | None needed | Scoped per service | Your logged-in session |
| State | Per conversation | Per conversation | Persistent across devices |
| Worst-case error | Wrong answer | Wrong record written | Wrong action on any file |
What Would Make the Desktop AI Agent Category Work
Four things have to arrive before this stops being an enthusiast product, and they are all tractable.
Self-verification
The single highest-value improvement would be an agent that checks its own output against the task before declaring completion. Verification failure is one of the four named failure modes, and it is the one a user cannot easily compensate for.
Asking better questions
Agents guess rather than clarify because clarifying looks like failure. A desktop AI agent that interrupts once at the start with two sharp questions would outperform one that silently assumes, and the training incentive currently points the wrong way.
Reversibility as a platform feature
Undo is the missing primitive. An agent operating inside a snapshot, with a one-click revert of everything it touched, changes the risk calculation entirely. That is an operating system feature, not a model feature.
An honest reliability number
Vendors publish capability benchmarks. What a buyer needs is a completion rate on their own class of task, with the harness disclosed. Until that is normal, every claim about a desktop AI agent completing real work has to be discounted by an unknown amount.
Frequently Asked Questions About Rabbit OS3
Do I need an r1 to use OS3?
No. OS3 runs on Windows, Mac and Linux machines, cloud VMs and dedicated AI machines, and you reach it through a browser, Telegram or standard messaging. The r1 remains a supported device rather than a requirement.
How many devices can one account control?
Up to five, sharing a single continuous conversation with persistent memory, identity and skills across all of them.
Is there a subscription?
Rabbit’s newsroom post does not state a price, and the product is built around bring-your-own-key, so the recurring cost you will actually pay is your own model provider’s bill.
Is rabbit still making the r1?
No. The r1 is discontinued and no R2 is planned. The company’s next hardware is a vibe-coding cyberdeck that will ship with OS3 as its default operating system.
Can a desktop AI agent be trusted with real work?
Partially. On the toughest published long-horizon benchmark the best reported result still failed a majority of tasks outright, so treat the agent as capable of drafting and executing under supervision rather than completing unsupervised.
What does bring-your-own-key actually cost?
Whatever your model provider charges for the tokens the agent consumes. Because a desktop AI agent takes screenshots and reads application state repeatedly, a long task can be input-heavy, so a provider with cheap cached input will cost noticeably less than one without.
Can I swap models without losing my setup?
Rabbit says models can be swapped without affecting context, memory or skills. If that holds, it is the most valuable property of the product, because it separates the durable agent layer from a model layer that changes every few months.
Is a desktop AI agent safe to run on a work machine?
Not without a policy. It inherits whatever your logged-in session can reach, and it will read text written by third parties. Run it on a secondary machine with scoped credentials, and decide in advance what it may send, buy or delete.
Will the cyberdeck make the r1 obsolete for existing owners?
No. Rabbit has kept the r1 as a supported device that OS3 can control, so an existing handset becomes one of the five connected devices rather than a dead product.
References
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.
