{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-31", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "mage-vl-cowork", "name": "Mage-VL-Cowork", "vendor": "Microsoft", "vendorUrl": "https://github.com/microsoft/Mage", "kind": "weights", "category": "desktop-automation", "summary": "Mage-VL-Cowork is Microsoft's open-weight 4B computer-use model. It reads desktop screenshots and answers each turn with either mouse and keyboard actions or a shell command, built on Mage-VL, under Apache 2.0.", "url": "https://www.anchorterminal.com/tools/mage-vl-cowork", "markdownUrl": "https://www.anchorterminal.com/tools/mage-vl-cowork.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mage-vl-cowork.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mage-vl-cowork.json", "repo": "https://huggingface.co/microsoft/Mage-VL-Cowork", "license": "Apache 2.0", "transports": [], "packages": [ { "registry": "huggingface", "name": "microsoft/Mage-VL-Cowork" } ], "auth": "none", "authNotes": "Not gated on Hugging Face. The files download with no account, token or terms to accept (gated false in the Hub's API, checked 2026-10-30).", "pricing": "free", "pricingNotes": "Free to download and use, commercial use included, under Apache 2.0, with the base Mage-VL also Apache 2.0, its Mage-ViT encoder MIT and its Qwen3-4B-Instruct-2507 language model Apache 2.0. No inference provider serves it on Hugging Face. Running it takes one GPU for 9.50 GB of BF16 files, about 12 GB with working memory (checked 2026-10-30).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights you download and run yourself, so there is nothing to pay per call and no payment protocol (checked 2026-10-30).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-30" }, "docsUrl": "https://github.com/microsoft/Mage/tree/main/mage_vl_cowork", "capabilities": [ "desktop.control", "desktop.scripting", "model.open-weights" ], "tags": [ "open-weights", "model", "computer-use", "gui-agent", "vision", "shell", "linux", "apache-2.0", "safetensors", "self-hosted", "new" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 61, "grade": "C", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "An open-weight model, graded by the open-weight checklist and ranked among open-weight models, not against tools", "rankOf": 1243, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "interface": 85, "reach": 60, "risk": 65, "upkeep": 54 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "capability", "name": "Capability", "weight": 35, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending for this listing. Nobody independent has published results for it in at least two areas yet, so its weight is shared across the other four and the total is capped at 61 until they do or our own runs start." }, { "key": "reach", "name": "Reach", "weight": 25, "effectiveWeight": 38.46, "score": 60, "points": 23.08, "reason": "Memory earns the full 30, since the only build is 9.50 GB of BF16 files that need about 11.4 GB with the fifth added. Runtimes get 5 for vLLM, whose released code carries the LLaVA-OneVision-2 architecture this model's config names, though Microsoft doesn't document it. Transformers runs it only through Microsoft's remote code, SGLang only in Microsoft's own container, and llama.cpp has nothing for it. Builds score 0, with no quantised build from Microsoft. Terms get 15 for Apache 2.0 with nothing added, the base models' licences included. Download gets 10 for an ungated repository, and hosted too 0, with no inference provider mapped.", "checked": "2026-10-30" }, { "key": "risk", "name": "Risk", "weight": 20, "effectiveWeight": 30.77, "score": 65, "points": 20, "reason": "File safety gets 15, safetensors only but loaded with trust_remote_code. Provenance gets 15 for files in Microsoft's organisation with a hash for every file. Licence risk keeps 15 under Apache 2.0. The security programme gets 10 for the repository's SECURITY.md route to MSRC and MSRC's public advisories. Agent guidance gets 10 for a statement that it runs arbitrary commands and a list of safeguards (sandbox, human confirmation, no credentials, allow-listing against injection), with nothing on trained refusals. Safety evaluation scores 0, as none is published.", "checked": "2026-10-30" }, { "key": "interface", "name": "Agent interface", "weight": 10, "effectiveWeight": 15.38, "score": 85, "points": 13.08, "reason": "Read for a computer-use model, the tool-calling, trained tool calling and structured-output lines stand for what it takes and returns. Microsoft gives the system prompt and both tool schemas verbatim, what comes back for each channel, the SGLang parser and its own parsing code (25). It was trained to emit up to 15 calls of one kind per reply (20). Each action is JSON against a documented schema (15). The chat template is in the repository (20). Reasoning control scores 0, as turning thinking off isn't documented, and context 5 for a 32,768-token trained window.", "checked": "2026-10-30" }, { "key": "upkeep", "name": "Documentation and upkeep", "weight": 10, "effectiveWeight": 15.38, "score": 54, "points": 8.31, "reason": "The card covers intended use, architecture, parameters, context and language, and misses limitations and a cut-off (14). Training data is described with named sets and sizes but no cut-off (5). The files are a day old (20). Nobody has asked anything yet, so responsiveness reads as none answered (0). It's a first release (5), and the files agree with the card (10).", "checked": "2026-10-30" } ], "assessment": { "date": "2026-10-30", "basis": "public evidence", "confidence": "low", "notes": { "capability": "Pending for this listing. Independent results were found in 0 areas (none), and Capability needs 2. Its weight is shared across the other four categories and the total is capped at 61 until there are more, or our own runs start.", "interface": "Read for a computer-use model, the tool-calling, trained tool calling and structured-output lines stand for what it takes and returns. Microsoft gives the system prompt and both tool schemas verbatim, what comes back for each channel, the SGLang parser and its own parsing code (25). It was trained to emit up to 15 calls of one kind per reply (20). Each action is JSON against a documented schema (15). The chat template is in the repository (20). Reasoning control scores 0, as turning thinking off isn't documented, and context 5 for a 32,768-token trained window.", "reach": "Memory earns the full 30, since the only build is 9.50 GB of BF16 files that need about 11.4 GB with the fifth added. Runtimes get 5 for vLLM, whose released code carries the LLaVA-OneVision-2 architecture this model's config names, though Microsoft doesn't document it. Transformers runs it only through Microsoft's remote code, SGLang only in Microsoft's own container, and llama.cpp has nothing for it. Builds score 0, with no quantised build from Microsoft. Terms get 15 for Apache 2.0 with nothing added, the base models' licences included. Download gets 10 for an ungated repository, and hosted too 0, with no inference provider mapped.", "risk": "File safety gets 15, safetensors only but loaded with trust_remote_code. Provenance gets 15 for files in Microsoft's organisation with a hash for every file. Licence risk keeps 15 under Apache 2.0. The security programme gets 10 for the repository's SECURITY.md route to MSRC and MSRC's public advisories. Agent guidance gets 10 for a statement that it runs arbitrary commands and a list of safeguards (sandbox, human confirmation, no credentials, allow-listing against injection), with nothing on trained refusals. Safety evaluation scores 0, as none is published.", "upkeep": "The card covers intended use, architecture, parameters, context and language, and misses limitations and a cut-off (14). Training data is described with named sets and sizes but no cut-off (5). The files are a day old (20). Nobody has asked anything yet, so responsiveness reads as none answered (0). It's a first release (5), and the files agree with the card (10)." }, "sources": [ { "what": "model card", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork", "seen": "2026-10-30" }, { "what": "gating, likes, downloads, parameter count, base model, created and last modified", "url": "https://huggingface.co/api/models/microsoft/Mage-VL-Cowork", "seen": "2026-10-30" }, { "what": "files, sizes and hashes, 26 files", "url": "https://huggingface.co/api/models/microsoft/Mage-VL-Cowork/tree/main?recursive=true", "seen": "2026-10-30" }, { "what": "commit history, two commits on 30 October 2026", "url": "https://huggingface.co/api/models/microsoft/Mage-VL-Cowork/commits/main", "seen": "2026-10-30" }, { "what": "discussions, none", "url": "https://huggingface.co/api/models/microsoft/Mage-VL-Cowork/discussions", "seen": "2026-10-30" }, { "what": "inference providers, none", "url": "https://huggingface.co/api/models/microsoft/Mage-VL-Cowork?expand[]=inferenceProviderMapping", "seen": "2026-10-30" }, { "what": "Apache 2.0 licence text", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/raw/main/LICENSE", "seen": "2026-10-30" }, { "what": "config, llava_onevision2, Qwen3-4B text config, 262,144 positions", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/raw/main/config.json", "seen": "2026-10-30" }, { "what": "chat template", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/raw/main/chat_template.jinja", "seen": "2026-10-30" }, { "what": "reference hybrid agent, read as text", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/raw/main/osworld_eval/mm_agents/mage_hybrid_agent.py", "seen": "2026-10-30" }, { "what": "reference GUI agent and action parser, read as text", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/raw/main/osworld_eval/mm_agents/mage_gui_agent.py", "seen": "2026-10-30" }, { "what": "Docker launcher", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/raw/main/osworld_eval/scripts/serve_sglang_docker.sh", "seen": "2026-10-30" }, { "what": "GitHub README for the model", "url": "https://raw.githubusercontent.com/microsoft/Mage/main/mage_vl_cowork/README.md", "seen": "2026-10-30" }, { "what": "full evaluation launcher, Docker provider by default", "url": "https://raw.githubusercontent.com/microsoft/Mage/main/mage_vl_cowork/osworld_eval/scripts/run_osworld_eval.sh", "seen": "2026-10-30" }, { "what": "technical report", "url": "https://raw.githubusercontent.com/microsoft/Mage/main/assets/mage_vl_cowork_tech_report.pdf", "seen": "2026-10-30" }, { "what": "security policy, MSRC route", "url": "https://raw.githubusercontent.com/microsoft/Mage/main/SECURITY.md", "seen": "2026-10-30" }, { "what": "base model card, licence and components", "url": "https://huggingface.co/microsoft/Mage-VL", "seen": "2026-10-30" }, { "what": "encoder licence, MIT", "url": "https://huggingface.co/api/models/microsoft/Mage-ViT", "seen": "2026-10-30" }, { "what": "language model licence, Apache 2.0", "url": "https://huggingface.co/api/models/Qwen/Qwen3-4B-Instruct-2507", "seen": "2026-10-30" }, { "what": "OSWorld-Verified leaderboard data, 149 rows, no Mage-VL-Cowork row", "url": "https://raw.githubusercontent.com/os-world/os-world.github.io/main/static/data/osworld_verified_results.xlsx", "seen": "2026-10-30" }, { "what": "OSWorld self-reported results, no Mage-VL-Cowork row", "url": "https://raw.githubusercontent.com/os-world/os-world.github.io/main/static/data/self_reported_results.xlsx", "seen": "2026-10-30" }, { "what": "Alibaba's table with the Qwen3.6-27B and Muse Glimmer-30B OSWorld-Verified figures Microsoft copies", "url": "https://huggingface.co/Qwen/Qwen3.8-27B", "seen": "2026-10-30" }, { "what": "vLLM 0.32.0 registry, LlavaOnevision2ForConditionalGeneration", "url": "https://raw.githubusercontent.com/vllm-project/vllm/v0.32.0/vllm/model_executor/models/registry.py", "seen": "2026-10-30" }, { "what": "vLLM's LLaVA-OneVision-2 implementation", "url": "https://raw.githubusercontent.com/vllm-project/vllm/v0.32.0/vllm/model_executor/models/llava_onevision2.py", "seen": "2026-10-30" }, { "what": "llama.cpp architectures, none for this model", "url": "https://raw.githubusercontent.com/ggml-org/llama.cpp/master/src/llama-arch.cpp", "seen": "2026-10-30" }, { "what": "community copies (Hansda GGUF)", "url": "https://huggingface.co/api/models?search=Mage-VL-Cowork", "seen": "2026-10-30" } ], "openQuestions": [ "Unchecked, Ollama's library and LM Studio's catalogue; runtimes score them as absent", "Unchecked, whether Microsoft Foundry serves this checkpoint; hosted too is scored as absent", "vLLM's 5 rests on the architecture name and design matching; Microsoft doesn't document vLLM and no one has shown this checkpoint loading in it. If the session reads that as unshown support, runtimes drop to 0 and Reach to 55", "Structured output reads the documented action JSON as typed output (15), as the parser and speech models were read; free-form JSON Schema output isn't documented", "The security programme's second 5 rests on MSRC's public CVEs recorded in the azure-mcp check, not on a page read today", "No independent OSWorld-Verified result exists, so Capability is pending and the total will be capped at 61", "The microsoft.github.io project page wasn't read" ] }, "negative": 0, "verdict": "A small computer-use cousin that looks at a Linux desktop and answers each turn with clicks and keys or a shell command, under Apache 2.0, in about 12 GB at BF16. Microsoft documents only its SGLang container and Transformers. The risks are an example harness that runs shell commands unapproved, and a headline score that is Microsoft's own.", "bestFor": "Agents with one GPU and a sandboxed Linux desktop that want a small local model to carry out office and file tasks by GUI and shell", "strengths": [ "4.74B parameters in 9.50 GB of BF16 safetensors, about 12 GB in memory on one GPU", "One policy that picks per turn between screenshot-grounded GUI actions and shell or Python commands, with up to 15 calls per reply", "Apache 2.0 with nothing added, ungated, and a licence chain (Mage-VL, Mage-ViT, Qwen3-4B-Instruct-2507) that allows commercial use", "The system prompt, tool schemas, sampling settings and a reference agent and launcher published, with the full OSWorld runner on GitHub", "A plain statement that it runs arbitrary commands, with sandbox, confirmation, credential and allow-listing advice" ], "weaknesses": [ "Loading runs Microsoft's Python with trust_remote_code, and the recommended runtime is a container in a personal Docker Hub namespace", "No quantised build from Microsoft, and no released runtime support Microsoft documents outside its container and remote code", "Its OSWorld-Verified result isn't on the OSWorld team's leaderboard, verified or self-reported, so it is Microsoft's own two-run figure", "No safety evaluation, no statement of trained refusals and no prompt-injection training, for a model that runs shell commands", "The example harness runs every shell command the model emits without a filter or approval, and rewrites a training password string to the guest's sudo password" ], "agentNotes": [ "Run it only in a disposable VM or container with no host mounts, credentials or local network, as the card says; OSWorld's Docker provider is the tested setting", "Quickest local load, `pip install \"transformers\u003e=4.57.3\" accelerate pillow torch torchvision qwen-vl-utils`, then AutoProcessor and AutoModelForCausalLM from microsoft/Mage-VL-Cowork with trust_remote_code=True and torch_dtype bfloat16", "To serve it, download the repository and run `MODEL_DIR=/path/to/Mage-VL-Cowork bash osworld_eval/scripts/serve_sglang_docker.sh`, which pulls xiaoyizhang/mage-vl-cowork:0.1.0 and listens on 127.0.0.1:30001; the card's bare sglang.launch_server command binds 0.0.0.0", "Use the card's MAGE_HYBRID_SYSTEM_PROMPT unchanged, render with apply_chat_template(enable_thinking=True), send base64 JPEG screenshots to SGLang's native POST /generate, temperature 0.7, top_p 0.8, max_new_tokens 4096", "Coordinates come back on a 0 to 999 grid; scale x by width/1000 and y by height/1000. Answer computer_use calls with a new screenshot and bash calls with text in tool_response, keeping three screenshots and folding older turns into one-line summaries", "Put a human confirmation step in front of bash and irreversible GUI actions yourself; the bundled MAGEHybridAgent has none", "vLLM 0.32.0 registers the LlavaOnevision2 architecture, but Microsoft doesn't document it; test it before relying on it" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61 } ], "editorialScores": { "interface": 85, "reach": 60, "risk": 65, "upkeep": 54 }, "provenanceScore": 67, "checked": { "categories": { "interface": "2026-10-30", "reach": "2026-10-30", "risk": "2026-10-30", "upkeep": "2026-10-30" }, "last": "2026-10-30", "oldest": "2026-10-30", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-10-30", "grade": "C", "kind": "listed", "method": "0.7", "score": 61 } ] }, "connect": { "install": "pip install \"transformers\u003e=4.57.3\" accelerate pillow torch torchvision qwen-vl-utils\n# then AutoProcessor.from_pretrained(\"microsoft/Mage-VL-Cowork\", trust_remote_code=True)\n# and AutoModelForCausalLM.from_pretrained(\"microsoft/Mage-VL-Cowork\", trust_remote_code=True, torch_dtype=torch.bfloat16, device_map=\"auto\")\n# system prompt: the card's MAGE_HYBRID_SYSTEM_PROMPT, verbatim", "http": "# after: hf download microsoft/Mage-VL-Cowork --local-dir Mage-VL-Cowork \u0026\u0026 MODEL_DIR=$PWD/Mage-VL-Cowork bash Mage-VL-Cowork/osworld_eval/scripts/serve_sglang_docker.sh\n# (Microsoft's SGLang container on 127.0.0.1:30001; prompts are rendered with the AutoProcessor chat template and sent to SGLang's native /generate)\ncurl --fail http://127.0.0.1:30001/health" }, "letme": { "capability": "https://letme.dev/desktop.control", "tool": "https://letme.dev/mage-vl-cowork" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "tokeneconomizer", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "copilot-studio-mcp", "power-automate", "foundry-local", "microsoft-decision-1", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph", "microsoft-graph-people" ], "weights": { "trainedBy": "Microsoft", "builtOn": "microsoft/Mage-VL (an intermediate checkpoint, Apache 2.0), itself Mage-ViT (MIT) with Qwen/Qwen3-4B-Instruct-2507 (Apache 2.0)", "params": "4.74B", "context": 32768, "goodFor": "Running a Linux desktop task end to end inside a sandbox, choosing per turn between screenshot-grounded clicks and typing and shell or Python commands, on one GPU with about 12 GB.", "runtimes": [ "vLLM" ], "builds": [ { "name": "Mage-VL-Cowork (safetensors)", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork", "who": "publisher", "precision": "bf16", "sizeGB": 9.5, "memoryGB": 12, "format": "safetensors", "runsOn": [ "Transformers (remote code)", "SGLang (Microsoft's container)", "vLLM (LlavaOnevision2, not documented by Microsoft)" ], "note": "Two BF16 shards, 4,563,695,792 and 4,919,972,344 bytes (9.48 GB), 9,500,368,318 bytes with every file in the repository. The only build from Microsoft" } ], "run": "hf download microsoft/Mage-VL-Cowork --local-dir Mage-VL-Cowork \u0026\u0026 MODEL_DIR=$PWD/Mage-VL-Cowork bash Mage-VL-Cowork/osworld_eval/scripts/serve_sglang_docker.sh", "runBuild": "Mage-VL-Cowork (safetensors)", "checked": "2026-10-30", "minMemoryGB": 12 }, "family": { "lab": "Microsoft", "family": "Mage", "url": "https://www.anchorterminal.com/open-weights/#microsoft", "others": [ { "name": "Mage-VL", "url": "https://huggingface.co/microsoft/Mage-VL", "params": "4B (4,741,793,792 by the Hub's count, plus a separate streaming gate file)" }, { "name": "Mage-ViT", "url": "https://huggingface.co/microsoft/Mage-ViT", "params": "0.32B (315,694,080 by the Hub's count)" }, { "name": "Mage-Flow-4B-Base", "url": "https://huggingface.co/microsoft/Mage-Flow-Base", "params": "4B" }, { "name": "Mage-Flow-4B", "url": "https://huggingface.co/microsoft/Mage-Flow", "params": "4B" }, { "name": "Mage-Flow-4B-Turbo", "url": "https://huggingface.co/microsoft/Mage-Flow-Turbo", "params": "4B" }, { "name": "Mage-Flow-Edit-4B-Base", "url": "https://huggingface.co/microsoft/Mage-Flow-Edit-Base", "params": "4B" }, { "name": "Mage-Flow-Edit-4B", "url": "https://huggingface.co/microsoft/Mage-Flow-Edit", "params": "4B" }, { "name": "Mage-Flow-Edit-4B-Turbo", "url": "https://huggingface.co/microsoft/Mage-Flow-Edit-Turbo", "params": "4B" } ] }, "notable": [ "Published on 30 October 2026 at 12:13 UTC; 23 likes and no recorded downloads on the Hub's 30-day count the same evening (https://huggingface.co/api/models/microsoft/Mage-VL-Cowork)", "Microsoft's card and technical report give 66.0 per cent on OSWorld-Verified (66.04, the mean of two runs at 65.33 and 66.75) on 361 tasks without Google Drive, a 50-step budget, 1920 by 1080 screens and Microsoft's own hybrid harness. These are the publisher's numbers, not our measurement. On 30 October 2026 neither the OSWorld team's verified table (149 rows, newest dated 1 August 2026) nor its self-reported table had a row for it (https://huggingface.co/microsoft/Mage-VL-Cowork)", "The card calls it the best result among 4B models. No model of 4B parameters or fewer on the OSWorld-Verified leaderboard scores above it; the closest small rows are MoE models with about 3B active parameters (OpenCUA-A3B at 19.9, Kimi-VL-A3B at 10.3), while H Company's Holo3-35B-A3B, 35B in total with 3B active, has 82.56 verified at 100 steps. The card's own table puts ScaleCUA-Qwen3.5-9B at 68.7. Since Mage-VL-Cowork isn't on the leaderboard, the rank is Microsoft's claim (https://raw.githubusercontent.com/os-world/os-world.github.io/main/static/data/osworld_verified_results.xlsx)", "The comparison with Qwen3.6-27B (63.9) and Muse Glimmer-30B (65.9) copies figures from Alibaba's Qwen3.8-27B card, which states no step budget for them. The same Alibaba table gives Qwen3.8-27B, also an Apache 2.0 27B model, 84.3, which Microsoft's table leaves out. Neither Qwen model has a row on the OSWorld-Verified leaderboard (https://huggingface.co/Qwen/Qwen3.8-27B)", "The card times one LibreOffice Calc task at 0:39 in 6 steps, done through Python in the shell, against 9:56 in 39 steps for Qwen3.6-27B clicking through the interface, and one GIMP task at 1:58 against 7:02. Microsoft's demonstrations, not a benchmark (https://huggingface.co/microsoft/Mage-VL-Cowork)", "Trained from an intermediate Mage-VL checkpoint in five stages, ending with online reinforcement learning on ScaleCUA's 1,988 published tasks, from 318,837 trajectories that a GPT-5.4 teacher produced on 293,806 tasks Microsoft synthesised with gpt-5.6-terra (https://raw.githubusercontent.com/microsoft/Mage/main/assets/mage_vl_cowork_tech_report.pdf)", "The first community build appeared eight hours after release, GGUF files at Q2_K to Q8_0 with a vision projector made by Hansda with its own conversion script; llama.cpp itself has no support for the architecture (https://huggingface.co/Hansda/Mage-VL-Cowork-GGUF)" ], "area": "developer", "details": [ { "label": "Surface graded", "value": "The open weights at huggingface.co/microsoft/Mage-VL-Cowork, read from the card, config, tokenizer config, chat template, preprocessor config, LICENSE, remote modeling code, the bundled osworld_eval agents and launcher, the Hub's metadata, file list and commits on 30 October 2026, with the microsoft/Mage GitHub README, SECURITY.md and mage_vl_cowork folder (raw files), the technical report PDF, the base Mage-VL card, the OSWorld leaderboard's data files and the runtimes' own code. The project page wasn't read. Nothing was downloaded beyond text files, and nothing was run" }, { "label": "Model", "value": "A vision-language model of the LLaVA-OneVision-2 kind (llava_onevision2 in the config, with Microsoft's own modeling code), Microsoft's from-scratch Mage-ViT encoder (24 layers, 16 by 16 patches, 3-D rotary positions) and a two-layer projector feeding a 36-layer Qwen3-4B-Instruct-2507 decoder. 4,741,793,792 BF16 parameters by the Hub's count, which the card rounds to 4B. Image and text in, text out" }, { "label": "Input and output", "value": "Each turn takes the task, folded one-line summaries of earlier steps, the three most recent screenshots (JPEG, 1920 by 1080 in the evaluation) and the four most recent full replies. It returns a think block, a one-sentence Action line and up to 15 tool calls of one kind, either computer_use (click, double_click, triple_click, move, drag, type, keypress, scroll, wait, screenshot, terminate, with coordinates on a 0 to 999 grid) or bash (one shell command, answered with merged stdout and stderr as text). The card gives the system prompt verbatim and says to use it unchanged" }, { "label": "Context", "value": "32,768 tokens, the window it was trained and evaluated at per the card. The Qwen3 decoder's config allows 262,144, which the card says the architecture supports but this model wasn't trained to use" }, { "label": "Files", "value": "Two safetensors shards, 9.48 GB in BF16, with tokenizer, template, configs, the remote modeling and configuration code, and the osworld_eval reference agents and Docker launcher, 9.50 GB in all. No pickle files. The Hub lists a SHA-256 for each LFS file" }, { "label": "Licence", "value": "Apache 2.0, with the full text in the repository's LICENSE file and in the card's metadata, nothing added. The base microsoft/Mage-VL is Apache 2.0, its encoder microsoft/Mage-ViT is MIT and its language model Qwen/Qwen3-4B-Instruct-2507 is Apache 2.0, so the chain allows commercial use. Training used trajectories from OpenAI models as teachers; the cards put no term on users for that" }, { "label": "Runtimes", "value": "Hugging Face Transformers 4.57.3 and later through Microsoft's remote code (trust_remote_code). SGLang through Microsoft's own container, docker.io/xiaoyizhang/mage-vl-cowork:0.1.0 (SGLang 0.5.2, PyTorch 2.8.0, Transformers 5.7.0), with --tool-call-parser qwen25; upstream SGLang has no llava_onevision2 model. vLLM 0.30.0 to 0.32.0 carry a LlavaOnevision2ForConditionalGeneration implementation of the same architecture, which Microsoft doesn't document and nobody has shown loading this checkpoint. llama.cpp has nothing for it; Ollama and LM Studio couldn't be checked" }, { "label": "Recommended settings", "value": "Temperature 0.7 (0.0 for one deterministic run), top_p 0.8, max_new_tokens 4096 shared by the think block, Action line and tool calls, enable_thinking on, three screenshots and three full turns kept, a 50-step cap, 3 seconds after each GUI action and 300 seconds per shell command, as in the 66.0 per cent configuration" }, { "label": "Hardware", "value": "One CUDA GPU in the card's Docker command (--gpus device=0, shared memory 8 GB, SGLang at 0.82 of GPU memory). No memory figure is stated. Training used 32 NVIDIA B200s and 1,120 CPU sandbox slots. The 9.50 GB of files fit 12 GB with a fifth added" }, { "label": "Training data", "value": "Open GUI grounding sets (UGround, UI-E2I-Synth, OS-Atlas, MolmoWeb, JEDI, SeeClick), 293,806 synthesised desktop and web tasks over 6,915 skills, 318,837 teacher trajectories (68.19 per cent GUI calls, 31.81 per cent shell calls), 563,700 coding and terminal trajectories and ScaleCUA's 1,988 tasks for reinforcement learning, with sizes per stage in the report. No collection cut-off is given" }, { "label": "Safety", "value": "The card says it's built and evaluated for isolated, disposable sandboxes and asks for a container or VM with no host files, local network or personal environment variables, human confirmation before irreversible actions, no mounted credentials, and outbound allow-listing against indirect prompt injection. No safety evaluation is published. The example harness runs every shell command the model emits inside the OSWorld guest without a filter or approval step, using sudo with the guest's password for its own setup" } ], "provenance": { "legalEntity": "Microsoft", "domain": "microsoft.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://huggingface.co/microsoft/Mage-VL-Cowork/commits/main", "securityTxt": "expired", "checked": "2026-10-30", "notes": [ "The files sit in Microsoft's microsoft organisation on Hugging Face, which the microsoft/Mage GitHub README links to through its Mage collection. The card names the Microsoft Mage Team as developer, and the release commits are by xiaoyizhang-microsoft.", "Nothing is hosted, so the Apache 2.0 licence stands in for terms of service and no privacy policy is scored.", "The changelog is the repository's commit history, two commits on 30 October 2026 (the initial commit and the release of weights, card and OSWorld reference). The base Mage-VL's last change was 10 August 2026.", "securityTxt is carried from the microsoft-decision-1 check of 10 October 2026, which found www.microsoft.com/.well-known/security.txt with an Expires date of 2026-09-23. The microsoft/Mage repository's SECURITY.md routes reports to Microsoft's MSRC guidance at aka.ms/SECURITY.md." ], "score": 67, "checks": [ { "check": "Legal entity named", "value": "Microsoft", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "microsoft.com, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the Apache 2.0 licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" }, { "check": "People named", "value": "5 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ] }, "humans": { "slug": "mage-vl-cowork", "checked": "2026-10-30", "company": "Microsoft", "people": [ { "name": "Bill Gates", "role": "Co-founder and technical adviser, Microsoft", "founder": true, "linkedin": "https://www.linkedin.com/in/williamhgates", "x": "https://x.com/BillGates", "bio": "Bill Gates co-founded Microsoft with Paul Allen in 1975 and led it through its growth in business and personal software. In 2008 he moved to full-time work at the Gates Foundation, which he chairs, and he founded Breakthrough Energy to back clean-technology companies.", "bioSources": [ "https://www.gatesfoundation.org/about/leadership/bill-gates" ], "page": "/people/bill-gates/" }, { "name": "Paul Allen", "role": "Co-founder, Microsoft, left day-to-day work there in 1983", "founder": true, "bio": "Paul Allen co-founded Microsoft with Bill Gates in 1975. He left day-to-day work at the company in 1983 but stayed on its board as vice-chairman, and co-founded Vulcan Inc. in 1986.", "bioSources": [ "https://en.wikipedia.org/wiki/Paul_Allen" ], "page": "/people/paul-allen/" }, { "name": "Satya Nadella", "role": "Chairman and CEO, Microsoft", "photo": "/assets/img/people/microsoft-satya-nadella.webp", "photoSource": "https://news.microsoft.com/source/leadership/", "bio": "Satya Nadella is chairman and chief executive of Microsoft, which he joined in 1992 and has led as CEO since February 2014. He earlier ran its Cloud and Enterprise group and led research and development for its Online Services Division, and before Microsoft was on the technology staff at Sun Microsystems.", "bioSources": [ "https://news.microsoft.com/source/exec/satya-nadella/" ], "page": "/people/satya-nadella/" }, { "name": "Kevin Scott", "role": "Chief Technology Officer, Microsoft", "photo": "/assets/img/people/microsoft-kevin-scott.webp", "photoSource": "https://news.microsoft.com/source/exec/kevin-scott/", "bio": "Kevin Scott is Microsoft's chief technology officer. He was earlier senior vice president of engineering and operations at LinkedIn, which he led through its IPO, and before that oversaw mobile ads engineering at Google, including the integration of AdMob. He hosts the Behind the Tech podcast and sits on Shopify's board.", "bioSources": [ "https://news.microsoft.com/source/exec/kevin-scott/" ], "page": "/people/kevin-scott/" }, { "name": "Xiaoyi Zhang", "role": "Microsoft Mage Team; first author of the Mage-VL-Cowork technical report", "page": "/people/xiaoyi-zhang/" } ], "peopleNote": "Started from data/humans/microsoft-decision-1.json (Microsoft, checked 28 October 2026). The company-level people, their roles, bios and photos are carried from it and weren't re-read today. Achint Srivastava, named there for Decision-1's launch, is left off as he isn't named on Mage's pages. The card names the Microsoft Mage Team as developer, and its citation, read on 30 October 2026, lists 22 authors with Xiaoyi Zhang first; both release commits on Hugging Face are by the account xiaoyizhang-microsoft. No personal profile links were added, since none is linked from Microsoft's Mage pages. ownership and investors are left out so land.py copies them from the Microsoft file (public, NASDAQ MSFT).", "companySocial": { "linkedin": "https://www.linkedin.com/company/microsoft", "x": "https://x.com/Microsoft", "github": "https://github.com/microsoft" }, "support": { "urls": [ "https://github.com/microsoft/Mage/tree/main/mage_vl_cowork" ], "community": [ { "label": "Hugging Face model community", "url": "https://huggingface.co/microsoft/Mage-VL-Cowork/discussions", "kind": "link" }, { "label": "GitHub issues (microsoft/Mage)", "url": "https://github.com/microsoft/Mage/issues", "kind": "link" } ], "contactUrls": [ "https://aka.ms/SECURITY.md" ] }, "sources": [ "https://huggingface.co/microsoft/Mage-VL-Cowork", "https://huggingface.co/api/models/microsoft/Mage-VL-Cowork/commits/main", "https://raw.githubusercontent.com/microsoft/Mage/main/README.md", "https://raw.githubusercontent.com/microsoft/Mage/main/SECURITY.md", "https://www.gatesfoundation.org/about/leadership/bill-gates", "https://en.wikipedia.org/wiki/Paul_Allen", "https://news.microsoft.com/source/exec/satya-nadella/", "https://news.microsoft.com/source/exec/kevin-scott/", "https://news.microsoft.com/source/leadership/" ], "ownership": { "status": "public", "exchange": "NASDAQ", "ticker": "MSFT", "checked": "2026-10-28", "sources": [ "https://www.nasdaq.com/market-activity/stocks/msft", "https://en.wikipedia.org/wiki/Microsoft" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mage-vl-cowork.json" } }