How do I stop prompt injection in a computer-use agent?

You cannot eliminate it, so contain it. A computer-use agent reads page content as perception and cannot reliably tell your instruction from text on the page. The working defence is layered: run the agent in a disposable VM or container, give it a scoped short-lived credential instead of the human's login, allowlist the domains it may reach, require human approval for state-changing actions like purchases and sends, and cap total steps so a hijacked agent stops rather than wanders.

Should a computer-use agent run on my laptop?

No. A workstation carries live browser sessions, SSH keys, cloud credentials and password manager state, and an agent driving that machine inherits all of it. Run agents in a disposable VM, container or dedicated cloud desktop with no persistent secrets, and destroy the environment between runs so any injected instruction cannot persist to the next task.

How many steps should I let an agent take?

Set both a step cap and a wall-clock cap, and start tight. A typical GUI task completes in 15 to 60 perception-action steps at roughly two to five seconds each. Capping at about 2x your measured p95 step count catches the failure mode where an agent loops on an element it cannot find. Without a cap a confused agent burns budget indefinitely, which on an output-heavy model is the most expensive kind of failure.

When should I use a script instead of an agent?

Whenever the flow is stable. A Playwright or Selenium script runs the same flow in milliseconds, costs nothing per run, is fully deterministic, and cannot be prompt-injected because it does not reason over page text. Agents earn their cost only where the interface changes, the task is under-specified, or writing selectors for every variant is impractical. Most production automation should be scripted, with an agent reserved for the genuinely variable tail.

Quick Answer

How to Deploy a Computer-Use Agent Safely: 2026 Guide

Published: September 5, 2026

The Short Answer

Computer-use agents got good in 2026 — GPT-6 Astra reports 72.6% on OSWorld 2.0 and Claude Opus 5 sits at 70.2–70.6%. They did not get safe. The deployment problem is unchanged: an agent that reads a screen cannot distinguish your instructions from instructions printed on that screen.

The six controls that actually matter, in order of how much risk they remove:

Isolate the environment — disposable VM or container, no persistent secrets
Scope the credential — short-lived, least-privilege, never the human’s login
Allowlist destinations — the agent reaches only domains you named
Gate state changes — human approval for purchase, send, delete, permission change
Cap the budget — hard step count and wall-clock limit
Log everything — every action plus screenshot, retained for audit

Last verified: September 5, 2026.

Step 1: Decide Whether You Need an Agent at All

Do this before anything else, because it removes most of the risk for most tasks.

A script (Playwright, Selenium, Puppeteer) executes a fixed flow against known selectors. It runs in milliseconds, costs nothing per execution, is deterministic, and cannot be prompt-injected because it never reasons over page content.

An agent perceives the screen or DOM, decides its own next action, and adapts when the page changes. It takes roughly two to five seconds per step, costs real money per run, and inherits the entire injection surface.

Completion criterion: you can state in one sentence why a script cannot do this task. Common valid answers: the interface changes weekly, the task is specified in natural language by a human each time, or the target has no stable selectors. “It was faster to prototype” is not a valid answer for production.

Step 2: Isolate the Execution Environment

Never run an agent on a machine that holds real state. A workstation carries live browser sessions, SSH keys, cloud CLI credentials and password manager state — an agent driving that desktop inherits all of it, and so does anything that hijacks the agent.

Target setup:

A disposable VM, container or dedicated cloud desktop
No persistent secrets on the image
Destroyed and recreated between runs, so an injected instruction cannot persist into the next task
Network egress restricted at the environment level, not just in the prompt

Completion criterion: you can delete the environment mid-run and lose nothing but the current task.

Step 3: Scope the Credential

The agent gets its own identity, never a human’s.

Least privilege — the exact permissions the task needs and nothing adjacent
Short-lived — tokens that expire on the order of the task duration
Separately revocable — killing the agent’s access must not lock out a person
Attributable — logs show the agent acted, distinctly from the human who dispatched it

If the task genuinely requires broad permissions, that is a signal to split it into a narrow agent step plus a privileged scripted step that the agent can only request, not perform.

Completion criterion: revoking the agent credential stops the agent and affects no human user.

Step 4: Allowlist Where It Can Go

Constrain destinations at the network layer, not in the system prompt. A prompt instruction like “only visit example.com” is a suggestion to a model that is currently reading attacker-controlled text; a proxy allowlist is enforcement.

Block by default, allow the specific domains the task needs, and log every denied attempt — denials are your earliest injection signal.

Completion criterion: an agent instructed mid-run to visit an unlisted domain fails at the network layer and the attempt appears in your logs.

Step 5: Gate Every State-Changing Action

Reads are cheap to get wrong. Writes are not. Require explicit human approval before the agent can:

Complete a purchase or move money
Send an email, message or form submission to an external party
Delete anything
Change permissions, sharing settings or account details
Install software or modify system configuration

The gate should present what the agent is about to do in concrete terms — target URL, exact values, recipient — not a summary the agent wrote about itself. A hijacked agent will describe its action honestly only by accident.

Completion criterion: a test run attempting an unapproved purchase halts and surfaces the exact intended transaction to a human.

Step 6: Cap the Budget

Two caps, both hard:

Step cap — roughly 2x your measured p95 step count for the task class. Typical GUI tasks land in the 15–60 step range.
Wall-clock cap — because a stuck agent can burn time without incrementing steps.

This is a cost control as much as a safety control. Computer-use loops re-reason over accumulated context at every step, and output tokens dominate the bill. On the Artificial Analysis agent harness in September 2026, measured cost per task ranged from $0.29 (GPT-5.6 Luna) to $9.18 (Claude Fable 5.1) — an uncapped loop on the expensive end is a genuinely bad afternoon.

⚠️ Context-length cliff: GPT-6 Astra reprices prompts above 272,000 tokens at roughly 2x input. Screenshot-heavy sessions accumulate toward that faster than text tasks. Compact or truncate scrollback rather than letting the loop grow unbounded.

Completion criterion: an artificially unsolvable task terminates at your cap with a logged reason, not a timeout from your billing alert.

Step 7: Log for Audit, Not for Debugging

Record every action with the screenshot that preceded it. When something goes wrong with an agent, the question is never “what did the code do” — it is “what did the model see, and what did it decide.” Action-only logs cannot answer that.

Retain long enough to investigate after the fact, and treat the logs as sensitive: they contain screenshots of whatever the agent was looking at.

Completion criterion: you can replay a completed run as a sequence of screen states and decisions without re-running the agent.

What This Does Not Fix

Be clear-eyed about the residual risk. Layered containment reduces blast radius; it does not make the agent trustworthy. Researchers have demonstrated AI browsers being steered by page and email content into navigating to banking sites, extracting data from open tabs, and attempting unauthorized purchases. Gartner has advised enterprises to restrict or block agentic browsers pending standardized security controls, telemetry and transparency.

Conventional browser security does not cover this class: an agent moves data across browser, SaaS, email and endpoint without a human initiating each hop, so per-hop controls never fire.

The practical posture for 2026: agents for perception and proposal, humans and scripts for consequential action.