Computer-Use Agents Need Boundaries, Not Just Better Prompts

A computer-use agent can operate software that was never designed as an API. That reach is useful precisely because it is powerful, and power needs containment. A prompt that says ‘be careful’ is not a security boundary.

Shrink the environment

Give the agent the smallest browser profile, file set, network surface, and account permissions that can complete the task. Separate read-only discovery from mutation. Keep credentials out of model-visible logs and do not allow a general-purpose session to inherit every capability of an employee workstation.

• Allowlist destinations and tools for each workflow
• Use short-lived, narrowly scoped credentials
• Require confirmation for money movement, messages, deletion, and permission changes
• Validate the target and payload immediately before an irreversible action
• Capture evidence and provide a recovery path for every completed mutation

Treat the screen as untrusted input

Web pages and documents can contain instructions aimed at the model rather than the user. The agent should extract facts from the interface while continuing to follow the workflow’s trusted policy. Content on screen cannot grant itself new permissions.

Make recovery a product feature

Prefer drafts, previews, staged changes, and reversible operations. The safest agent is not one expected to be perfect; it is one designed so a mistake stays visible, bounded, and cheap to undo.