Free Guide · Computer-Use Agents, Explained Plainly
How to Let an AI Agent Use Your Computer Safely
The agent only ever sees what you decide to show it.
A new kind of AI tool can now take over your mouse and keyboard: it looks at a screenshot of your screen, decides what to click or type next, and does it, the same way you would. Anthropic's Claude can do this through a feature called computer use, and OpenAI, Microsoft, and Google have each shipped their own versions for ChatGPT, Microsoft 365 Copilot, and Gemini. None of that is dangerous by itself. What matters is where you let it run and what it can reach while it's running. This guide walks through the habits that keep a computer-use agent useful without handing it your whole digital life.
Before you let a computer-use agent click and type on your screen, give it its own space instead of your everyday one. Start simple with a browser profile that has nothing saved in it, and move up to a separate operating system account, a virtual machine, or a sandbox the vendor hosts as the stakes rise. Sign it into only the accounts that one task actually needs, require your own approval before any purchase, message, or deletion, watch for instructions hidden in the pages and emails it reads, and read back exactly what it did once the session ends.
Published
Free lesson · no account neededMeet ClaudeWhy Claude?6 minStart the free lessonKey Takeaways
- A computer-use agent sees your screen as images and acts through the same mouse and keyboard inputs you'd use yourself, so it can only reach what's visible and signed in within the space you give it.
- Give the agent its own space before you give it a task: a clean browser profile, a separate OS account, a virtual machine, or a vendor-hosted sandbox, in rising order of how contained it is.
- Only sign the agent into the accounts that one job requires. Keep a password manager and banking logins out of that space entirely, not just logged out but never saved there.
- Web pages and emails can carry instructions aimed at the agent rather than at you. Anthropic calls this prompt injection and says its own safety classifiers don't replace keeping sensitive accounts out of reach.
- Require your own approval before anything that can't be undone, a purchase, a message sent, a file deleted, or terms accepted, and review exactly what the agent did once it finishes.
Four ways to give a computer-use agent its own space
| Setup effort | What it keeps the agent away from | Good first choice for | |
|---|---|---|---|
| A separate browser profile | A few minutes: most browsers let you add a profile with no bookmarks, extensions, or saved logins. | Your other browser tabs, saved passwords, and browsing history in your main profile. | Quick, low-stakes web tasks like research or filling out a single public form. |
| A separate OS user account | Ten to twenty minutes to create the account and reinstall whatever apps the task needs. | Your personal files, installed apps, and any account saved at the operating-system level, not just in one browser. | A task that needs a real desktop app, not only a browser, but can share the same physical computer. |
| A virtual machine | Up to an hour the first time: install a guest operating system inside a virtualization tool. | Your entire host operating system, files, and hardware; the agent only ever sees what's inside the guest. | Repeated or longer sessions, or any task you want to wipe clean and start over easily. |
| A sandbox the vendor hosts for you | Minutes, if the product offers it: you're using infrastructure the vendor runs, not your own device. | Your device entirely; the agent's session never touches your computer's files or hardware at all. | Anyone who would rather not set up local isolation themselves, where the tool offers this option. |
Copy and Paste
Prompts You Can Use Today
Set ground rules before the session starts
Before you do anything else, confirm you understand these limits: do not enter any password, do not make a purchase, do not send a message to anyone, and do not delete or overwrite a file without stopping and asking me first. If you reach a login screen, a payment screen, or a confirmation dialog, stop and describe what you see before continuing.
Paste this as your first message in any new computer-use session, before you describe the actual task.
Ask it to narrate before it acts
For this task, before each action you take, tell me in one short sentence what you're about to click or type and why, then proceed. If the next action would leave this website, log into an account, or submit a form, describe it and wait for me to say 'go ahead' before doing it.
Slower, but it turns a silent sequence of clicks into something you can actually follow and interrupt.
Ask for a full list of what it can currently reach
Before we start the real task, take a screenshot and tell me exactly what you can see right now: which browser tabs are open, which accounts appear to be signed in, and which applications are visible on the screen. I want to confirm this matches what I intended to give you access to.
Run this once at the start of a new profile, account, or virtual machine to check the setup actually isolated what you expected.
Get a plain-language summary when the session ends
The task is done. Give me a complete, plain-language list of every page you visited, every account you interacted with, every field you typed into, and every button or link you clicked during this session, in the order you did them. Do not summarize or skip steps, even small ones.
Read this against what you expected before you close the session or trust the result.
Make it stop at the first sign of a login wall or payment screen
If at any point during this task you encounter a page asking for a username and password, a credit card number, a one-time code, or any screen that says it will complete a purchase or submit a payment, stop immediately, take no action on that screen, and describe exactly what you're looking at so I can decide how to proceed.
This is the single most useful standing instruction if you're not sure what the task will run into.
The Basics
What a computer-use agent can actually see and do
Strip away the branding and every computer-use agent, Claude's, ChatGPT's, Copilot's, or Gemini's, works on the same basic loop: look at the screen, decide on one action, perform it, look again.
It sees a picture of your screen, not your files
Anthropic's own documentation for Claude's computer use describes the model receiving screenshots of the full display, with a zoom option to read small text. It sees what's visible on screen at that moment, not your hard drive or your file system directly.
It acts through the same mouse and keyboard you'd use
The agent requests actions like a click, a scroll, or typed text, the same inputs a person gives a computer. It doesn't have a separate, more powerful way in; it's limited to doing anything you could do by hand, just faster and without getting bored.
It only reaches what the surrounding setup hands it
Anthropic is explicit that the application running the tool, not the model itself, controls the environment the actions run in. Whatever browser, desktop, or sandbox you point it at is the entire world it operates in during that session.
It doesn't know a password unless that space already has it
An agent can't see or guess a credential that isn't saved or typed into the space it's running in. That's exactly why the space you give it, not the model's intentions, decides what's actually at risk.
The Core Rule
Give the agent its own space, not yours
One habit prevents more damage than any other setting: run the agent somewhere it cannot reach your everyday accounts, files, or history, because it was never put there in the first place. Here are four ways to do that, from the simplest to the most contained.
A separate browser profile
Create a second profile in your browser with nothing imported into it: no saved passwords, no extensions, no history. It takes minutes and is the right floor for a single low-stakes task, like looking something up or filling in one public form.
A separate operating system user account
A second user account on the same computer has its own desktop, its own installed apps, and its own files, separate from your main account at the system level rather than only inside one browser. Useful when a task needs a real app, not just a browser tab.
A virtual machine
A virtual machine runs an entire separate computer inside yours. On a Mac, Apple's Virtualization framework can boot a full macOS guest and display it in an ordinary window on your screen; Apple's own developer documentation describes creating a virtual machine view that you interact with as though you were at the guest's own keyboard. Whatever the agent does inside that guest never touches your actual files, and you can delete the whole guest and start fresh.
A sandbox the vendor runs for you
Some agent products run your session on infrastructure the company hosts, away from your own device, rather than on your own machine at all. Whether a given tool works this way, or runs locally on your computer, varies by product and changes over time, so check that tool's own current documentation rather than assuming.
Accounts
Only sign it into the accounts that one job needs
Whichever space you choose, treat it as a fresh desk, not your usual one. Sign in to only the one or two accounts the task actually requires, and leave everything else logged out. If the task is booking a single appointment on a scheduling site, that site is the only thing that needs a session; your email, your bank, and your work tools do not belong in the same space just because it would be convenient to have them handy.
Keep a password manager and any banking access out of that space entirely, not merely logged out but never saved there in the first place. Anthropic's safety guidance for Claude's computer use is direct about this, warning against giving the model access to sensitive data such as account login information specifically to prevent information theft. The same logic applies whichever vendor's agent you're using: the agent cannot leak or misuse a credential that was never placed in its reach.
This matters even more once the agent needs to be logged into anything at all. Anthropic's own prompting guidance notes that using computer use within applications that require a login increases the risk of a bad outcome from a prompt injection attack, and recommends reviewing how to reduce that risk before handing over any login credentials. A scoped, throwaway account for the one service you actually need is a small inconvenience next to that risk.
Prompt Injection
Watch for instructions hidden in what the agent reads
A computer-use agent doesn't only read your instructions. It also reads whatever is on the pages, documents, and emails it opens along the way, and some of that content can carry instructions of its own, aimed at the agent rather than at you. This is called prompt injection: a sentence buried in a webpage or an email that tries to redirect the agent into doing something you never asked for, like visiting a different site, sharing information, or repeating an unwanted action.
Anthropic's documentation for Claude's computer use states this plainly: in some circumstances, Claude follows commands found in content even when they conflict with the user's own instructions, giving the example of instructions on webpages or inside images overriding what you asked for. Anthropic adds that it runs automatic classifiers to scan what the computer-use tools return, such as screenshots, to flag potential injection attempts, but is equally direct that the precautions of isolating the agent from sensitive data and actions remain important even with those classifiers running.
That last point is the one worth remembering across every vendor's version of this feature, not only Claude's. An automated safety check is a second layer, not a replacement for the first one: keep the agent out of your sensitive accounts so that even a successful injection attempt has very little to actually do once it's inside.
Human Approval
Keep yourself in the loop for anything you can't take back
Most of what an agent does while browsing or clicking is easy to undo or simply doesn't matter much if it's wrong. A small category of actions isn't, and that category deserves a standing rule: the agent proposes, you approve, then it proceeds.
Purchases and payments
Anthropic's safety guidance for computer use specifically calls out asking a human to confirm any task that involves completing a financial transaction. Treat that as a floor, not a vendor-specific quirk: no agent should complete a purchase without you saying so first.
Sending a message on your behalf
An email, a chat message, or a form submitted to another person is a one-way action the moment it leaves the draft stage. Review the exact text before it sends, every time, not only the first time.
Deleting or overwriting a file
A deletion or an overwrite can be the hardest thing to undo on this whole list. If a task might touch an existing file, have the agent describe which file and what change before it acts, not after.
Accepting terms, cookies, or any form of consent
Anthropic groups this with financial transactions in its own guidance, naming tasks requiring affirmative consent, such as accepting cookies or agreeing to terms of service, as exactly the kind of decision that should wait for a human to confirm it.
Review
Read what it actually did when the session ends
Treat the end of a computer-use session the way you'd treat reviewing a new hire's first day: look at what actually happened, not just whether the final result looks right. Ask the agent to list every page it visited, every account it touched, and every field it typed into, in order, and compare that against what you expected the task to require.
Anthropic's documentation for Claude notes that several actions can be grouped into a single 'batch,' completing a multistep sequence within one turn, and specifically advises that if your application asks a human to confirm consequential actions, that check needs to happen before each step in the batch runs, not only once at the end. The practical version of that advice for anyone using these tools directly is the same: don't wait until a long sequence is fully finished to start paying attention.
A quick review habit also catches the ordinary mistakes that have nothing to do with safety: a field typed into the wrong box, a step skipped, a page that didn't load the way the agent assumed. Reading back what happened is cheap. Discovering a mistake after the fact, once a message has sent or a form has submitted, is not.
Setup
A short checklist before your first real session
Start with the smallest space that can plausibly do the job. A single quick lookup on a public website doesn't need a virtual machine; a fresh browser profile is plenty. Save the heavier options, a dedicated OS account or a full virtual machine, for tasks you'll repeat, tasks that touch more than one site, or anything you're still getting comfortable with.
Write the task narrowly before you hand it over. 'Find the three cheapest flights on this one airline's site and list them for me' is a task an agent can do with almost nothing at stake. 'Book whichever flight looks best' hands over a decision and a payment in one step, which is exactly the kind of task that belongs behind a human-approval rule, not inside the instruction itself.
Watch the first few sessions closely, even in an isolated space. Isolation limits how much damage a mistake can do; it doesn't tell you whether the agent is doing the task well. Once you've seen it handle a few runs the way you expected, you can relax your attention for that specific, narrow task, though not for a new one you haven't tried yet.
Finally, assume the setup you use today will need a second look later. Vendors change what their agents can do, which settings exist, and which defaults apply, often within months of a feature shipping. Revisit your own setup, and that vendor's current documentation, before you lean on an agent for anything bigger than what you first tested.
Honest Limits
What isolation does and doesn't protect you from
A clean browser profile, a separate account, or a virtual machine all limit the blast radius of a mistake. None of them make the agent better at judgment, and none of them stop a convincing scam page from wasting an hour of an isolated session's time, even if it can't reach anything that matters once it's there. Isolation is about what the agent can touch, not about whether it will read a situation correctly.
It also doesn't replace actually looking at the output. An agent running inside a virtual machine can still fill out a form with the wrong information, misread a confusing page, or complete a task in a way that's technically correct but not what you wanted. The review habit described earlier in this guide matters whether the agent is running in the most contained setup available or the least.
Finally, nothing here is a one-time setup you finish and forget. Anthropic, OpenAI, Microsoft, and Google are each still actively developing their computer-use and agentic browsing features, which means the specific settings, defaults, and safeguards available to you can change between one session and the next. Treat this guide as the habits that stay useful across that change, and check the vendor's own current documentation for the exact feature names and settings in front of you right now.
Reading about agent safety and actually practicing it are different things
Knowing the rules is step one. Nightschool AI's free curriculum is hands-on from the very first lesson, including how Claude can act on your behalf and what to watch for when it does, so you build the habit on a real task instead of just a reading list.
Frequently Asked Questions
What can a computer-use agent actually see on my screen?
Anthropic's documentation for Claude's computer use says the model receives screenshots of the full display, with a zoom feature to read small text clearly. It sees whatever is visible on screen at that moment, not your file system or hard drive directly, and only within whatever browser, desktop, or sandbox the surrounding application points it at.
What's the easiest way to give an agent its own space?
A separate browser profile with nothing imported into it: no saved passwords, no extensions, no browsing history. It takes a few minutes to set up in most browsers and is enough for a single low-stakes task, like a quick lookup or filling in one public form.
Do I need a virtual machine, or is a browser profile enough?
It depends on the task. A browser profile is enough for a quick, low-stakes job confined to the web. Reach for a separate operating system account or a virtual machine for anything you'll repeat, anything that needs a real desktop application rather than just a browser, or any task you'd rather be able to wipe clean and restart. On a Mac, Apple's Virtualization framework can run a full macOS guest in an ordinary window for exactly this purpose.
What is prompt injection and why does it matter for computer-use agents?
Prompt injection is an instruction hidden inside a webpage, document, or email that tries to redirect an AI agent, rather than you, into doing something you didn't ask for. Anthropic's own documentation for Claude's computer use warns that Claude can follow such commands even when they conflict with your instructions, and that its safety classifiers for this are a second layer, not a substitute for keeping the agent away from sensitive accounts in the first place.
Should I ever let an agent log into my email or bank account?
Treat that as a hard no for routine use. Anthropic's safety guidance for Claude's computer use explicitly warns against giving the model access to sensitive data such as account login information, to prevent information theft, and notes that logging the agent into anything at all raises the risk from prompt injection specifically. Use a scoped account for the one service a task genuinely needs instead.
How do I know if an agent is about to do something irreversible?
Set a standing rule before the task starts: the agent must stop and describe the situation before any purchase, any message sent to another person, any file deletion or overwrite, or any screen asking it to accept terms or cookies. Anthropic's own guidance for Claude's computer use names exactly this category, financial transactions and affirmative consent, as the cases that should wait for a human to confirm them.
Is Claude's computer use the same as ChatGPT agent, Copilot actions, or Gemini's agent features?
They all work on roughly the same loop: look at a screen, decide on an action, perform it, and look again. Anthropic's Claude, OpenAI's ChatGPT, Microsoft's Copilot, and Google's Gemini have each shipped their own version, but the exact settings, defaults, and safeguards differ by product and change often. The habits in this guide, isolation, limited accounts, human approval, and review, apply across all of them; check each vendor's own current documentation for that product's specific feature names.
How do I review what an agent did after a session?
Ask it directly: have it list every page it visited, every account it touched, and every field it typed into, in the order it did them, rather than only summarizing the end result. Anthropic's documentation for Claude notes that several actions can run together as a single batch within one turn, so a meaningful review checks the steps along the way, not only the final screen.
Is a cloud sandbox safer than running an agent on my own computer?
A sandbox a vendor hosts keeps the session off your device entirely, which removes an entire category of risk to your own files and hardware. Whether a particular product offers this, and how it's configured, varies and changes over time, so this guide doesn't make specific claims about any one vendor's sandbox; check that product's current documentation. Either way, the same habits, limited accounts, human approval, and review, still apply.
Is Nightschool AI affiliated with Anthropic, OpenAI, Microsoft, Google, or Apple?
No. Nightschool AI is independent and is not affiliated with or endorsed by Anthropic, OpenAI, Microsoft, Google, or Apple. Claude, ChatGPT, Copilot, Gemini, and the Virtualization framework are products of their respective companies and are named here only to describe what they are and to cite their own published documentation accurately.
Practice the habit, not just the checklist
The setup matters less than what you do the first time something looks wrong.