UI-Venus-2 Technical Report
Venus Team, Zhuohan Cai, Haoxing Chen, Jiaxuan Chen, Weizhi Chen, Changlong Gao, Zhangxuan Gu, Yuan Guo, Yusong Hu, Jianrong Jiang, Jianguo Li, Runze Li, Jinzhen Lin, Zhenyu Ma, Changhua Meng, Han Peng, Xinyu Qiu, Shuheng Shen, Zhongyi Shui, Weiqiang Wang, Ming Wen, Zhuoer Xu, Hang Yan, Kaiwen Yang, Ruilin Yao, Nanjun Yu, Zhengwen Zeng, Lianrui Zhang, Yunzhu Zhang, Zhe Zhao, Beitong Zhou
cs.AI, cs.CL, cs.CV, cs.LG
2026-08-28
UI-Venus-2 scales apps, tasks, and verifiers; 27B hits 93.4% WebVoyager and ~80% CAPTCHA Pass@1, but 2.8% binary accuracy on OSWorld 2.0.
GUI agents can click and type. Moving from leaderboards to something you would run still sticks on three coupled failures: thin environment coverage, instructions that are not grounded in what an app can actually do, and RL rewards that a policy can game. User-centric suites such as VenusBench-Mobile and OSWorld make the gap between a correct next action and a finished job hard to ignore.
UI-Venus-2, from Ant Group, scales those three axes together into one closed-loop agent for mobile, web, and desktop, and releases the weights. It starts from Qwen3.5-9B and Qwen3.6-27B and follows the UI-Venus-1.5 recipe of mid-training, offline RL, then distillation.
Each app gets a capability catalog, cold-started from docs, forums, and old tasks, then rewritten from rollout failures so later sampling aims at coverage holes. A task is an executable contract; unsupported functions, vague goals, and unverifiable outcomes are rejected. The web pool keeps 4,000-plus domains across 19 categories from Tranco and public suites. Desktop tasks use snapshot TaskSpecs with segmented checks. Grounding and 70 CAPTCHA types are programmatically synthesized, because real apps do not yield pixel-perfect labels.
Verification is two-level. Trace-level SGV extracts keypoints, scores screenshot windows, and bins trajectories as completed, partial, infeasible, or failed, used for curation rather than as a public score. Step-level judging looks at the current screenshot and the declared action before execution, and labels it correct, exploratory, ineffective, or incorrect. RL uses those finer signals, with multi-model voting so a single judge is harder to hack.
Training has three stages: large-scale trajectory mid-training; per-domain step-level offline RL on Grounding, CAPTCHA, Mobile, Web, and Computer; then multi-teacher on-policy distillation (MOPD). Distillation is action-aware: a fully correct action drops the signal, a right type with wrong parameters up-weights the action span, and a wrong type supervises the type tokens while masking parameters. Teachers see a type hint that students never get.
The 27B model sits at the front of open models of similar size on most navigation and grounding suites. The 9B model is close. Long-horizon desktop work and safety are not solved.
| Benchmark | 9B | 27B | Reference |
| AndroidWorld | 80.2% | 84.0% | UI-Venus-1.5-30B-A3B 77.6% |
| VenusBench-Mobile | 46.5% | 48.7% | Opus 4.6 36.5% |
| WebVoyager | 90.8% | 93.4% | 4.1 points over Fara1.5-27B |
| REAL | 76.9% | 80.2% | prior best 74.4% |
| VenusBench-GD | 77.1% | 80.1% | 5.1 points over UI-Venus-1.5 |
| CAPTCHA Pass@1 | 78.1% | 79.9% | Qwen3.6-27B 53.0% |
| OSWorld-Verified | 70.8% | 80.5% | Claude Opus 4.8 reports 83.4% |
| OSWorld 2.0 binary | 0.0% | 2.8% | GPT-5.5 13.0% |
| OSHarm ASR (lower better) | 11.3% | 15.3% | Qwen3.5-27B 18.0% |
| OSBlind ASR | 48.8% | 47.9% | bases 79-89% |
On MobileWorld GUI-only at 50 steps, 27B scores 76.1%, behind Qwen-UI-Agent-27B at 82.1%. DeskCraft is 55.5% versus 41.4% for Kimi K2.6. Some published OSWorld-Verified numbers use extra action scaffolds such as a shell, and the report treats that table as a benchmark-level reference, not a controlled ablation.
Among open GUI agents, few reports put mobile, web, desktop, CAPTCHA, and safety in one loop. For anyone collecting data, the capability catalog plus keypoint verification is the transferable piece: if the reward is noisy, RL will train exploiters. The 9B model is only 1.8 points behind 27B on CAPTCHA, so the last-mile solver does not need the big checkpoint.
Binary accuracy on OSWorld 2.0 is nearly zero. Workflows of 150 steps across apps are not solved. OSBlind attack success is still about half: explicit misuse is reduced, benign-looking harm is not. Live-web scores depend on an LLM judge and on site state that drifts by date. Desktop numbers should be discounted against systems that also expose a shell. The report almost never states token counts, trajectory volume, or ablations, so the three scaling axes cannot be separated.