# Mac automation with judgment: the AI that runs FCT can drive the Mac, and it stopped at a security setting

The AI that runs FCT can see the screen and work the Mac directly. On its first real job it hit a security setting, refused to guess, and handed it back.

By Fernando Caudillo Tafoya · FCT Technologies · August 11, 2026

You already ask AI to do things it can only describe. It tells you which setting to change, which button to click, which field to fill. Then you go do it yourself. The assistant lives in the chat window. The work lives on the screen, in the app, in the form, somewhere it can’t reach.

On July 9 we closed that gap for the operating layer we run FCT on. It got hands. It sees the screen, reads what the app in front of it says it contains, and works the Mac directly. Not a description of the work. The work.

Its first real job came the same night. We were moving FCT’s email automations off a personal login and onto a service account, which meant working through a Google admin console. It saw the console, read the interface, and worked the screens alongside the setup: the click-here-then-there chore that had always been done by hand.

Then it stopped.

The last two actions lived inside a form in a browser, tied to a security setting. A browser does not hand out what is inside the page that way, only the window around it. It could have guessed at coordinates. On a security setting, a guess is a wrong click you find out about later. So it reported what it could and couldn’t see, and handed two fifteen-second actions back to a person.

That is the part worth announcing. Not the reach. The restraint.

The mechanism is plain and entirely ours. It sees the screen. It reads the same description of an app that VoiceOver reads aloud. It acts through the system’s own controls, which is why it never has to move your cursor: it presses and fills things directly, so the Mac stays usable while it works. Nothing rented, nothing installed from a vendor, no outside service in the path.

The gap it stopped at is closed now. A browser channel runs under the same owned control layer we [wrote about in July](https://fct-technologies.com/newsroom/mcp-read-only-is-a-claim/). The runtime assigns the risk, not the tool, and anything that sends, posts or submits has to be confirmed by a person at the moment it happens. The LinkedIn version of this article went out through exactly that path, with a human approving every click that acted. A month of real use later, the boundary is still the feature.

This is us running what we sell. The computer-use body isn’t a product on a shelf. Second Brain OS, the client form of this layer, is in testing, and we’re not going to pretend otherwise. What we will say plainly is the standard behind it: capability and control boundary ship together, or the capability isn’t finished.

Software that can act for you is only worth having if it knows which actions aren’t its to take. Anyone can build the reach. The judgment about where to stop is the part you should be buying.

## Frequently asked questions

**How does it actually see and act?**

It sees the screen the way you do. It reads the same description of an app that VoiceOver reads aloud to a blind user, and it works the Mac through the system's own controls. Nothing rented, nothing installed from a vendor, no outside service in the path. It runs on the machine and the code is ours.

**Does it take over the cursor while you're working?**

Not by default. The everyday mode presses buttons and fills fields through the accessibility layer without moving the cursor, so it can work while you use the Mac. Moving the real pointer is a separate mode you choose, for a demo or for a control that offers no other way in.

**What stops it from clicking something it shouldn't?**

Every action carries a risk level, and the runtime assigns it, not the tool. Reading the screen runs freely. Anything that sends, posts or submits waits for a person to confirm at the moment of the click, and the confirmation is tied to that exact action. A tool cannot lower its own rating to get past the gate.

**Can I buy this?**

Not as a product on a shelf. It is part of the operating layer FCT runs itself on. Second Brain OS, the client form of that layer, is in testing and not generally available. What transfers today is the standard: when we build automation for your business, the capability and the control boundary ship together.