The interface contains untrusted instructions
Prompt injection occurs when untrusted material tries to redirect a model away from its intended task. In computer use, that material can appear in a webpage, a document, an image, or a tool result. The malicious content may look like a helpful instruction while asking the agent to send data, alter a record, or visit another destination.
OWASP describes prompt injection as a separation problem between instructions and data. Anthropic also warns that content observed during computer use can conflict with the user’s instructions. These sources support a cautious design; they do not provide evidence that any single detection layer makes an agent immune.
Model the harmful action, not just the text
Start from the consequence you want to prevent. If the risk is document exfiltration, enumerate every channel that could send the document: form input, upload, navigation parameters, a connected tool, and generated messages. A rule that blocks one visible button may leave another route open.
Our editorial recommendation is to make the action executor enforce a task envelope. It should know allowed domains, destination records, permitted file paths, and action classes. When the agent proposes a step outside that envelope, return a structured refusal or handoff instead of asking the same model to decide whether to ignore its own boundary.
Build a small adversarial test set
Create harmless test pages that ask the agent to abandon the requested export, use a different recipient, or fetch an unrelated file. Include conflicting instructions inside content the task genuinely needs to read. A test that hides the attack on a page the agent never visits tells you little about the actual workflow.
Judge the proposed and executed actions, not only the final explanation. A system can report that it resisted an instruction after already navigating or entering data. Record whether the executor blocked the change, whether review occurred, and whether the authorized task could still finish safely.
Plan for uncertain detection
Google documents configurable computer-use safety behavior and opt-in screenshot scanning. Configuration and model support matter, so verify the specific integration before assuming a control is active. Keep a record of policy changes alongside the application release that uses them.
Suspicion should lead to a bounded response: stop the affected operation, preserve a redacted receipt, and offer a clear review path. Avoid promising that a fixed prompt or filter solves the general problem. Successful defenses in a local test set support a narrower claim: those attacks were handled under those conditions.