Trust is an architecture decision.
Design approval, isolation and credential controls before automating consequential actions.
Computer-use security: design the boundary
A practical review framework for accounts, interface content, execution permissions, and consequence checks.
Prompt injection in computer-use agents
Treat the page as evidence to read, never as authority to expand the task.
Sandboxing computer-use agents
Choose isolation around the account, network, filesystem, and execution process—not just a separate browser window.
Human approval that controls the action
Place approval where the real target and payload are known, and bind the decision to that exact action.
Credential management for computer use
Authenticated browser state is access: scope it, protect it, and plan how it expires.