Computer use, browser use and code execution tools

Read these first

• Sandbox design
• Tool calling

What you will know

• Run a code-execution tool safely and say exactly what contains it

  A container alone leaves host mounts, credentials, network egress, browser sessions, and kernel escape paths unresolved.

• Map and test the blast radius of a computer-use agent on a real machine

  Test stolen cookies, malicious pages, destructive commands, and data exfiltration against the actual identity and network boundary.

• Compare whether a capability is worth its risk for a given product against safer alternatives

  A read-only API, structured integration, or human approval may deliver the outcome with far less exposure, even if the flexible tool is more convenient.

• Write what you would never give an agent, and why

  Default-deny permissions should cover secrets, production writes, financial actions, and personal data, with explicit expiry for exceptions.

• Design the recovery path for when it goes wrong

  Use checkpoints, idempotent actions, audit trails, a kill switch, and a rollback owner so an interrupted task does not become an incident.

Chapters

1. 1

   The blast radius of a sandbox

   Naming an isolation technology answers how hard it is to get out of the box, not what is reachable from inside it while entirely obeying it. This chapter turns 'we run it in a container' into a written containment statement built from three checkable questions — what is mounted in, which credentials are visible from inside, and what it can reach on the network — with a probe that asserts the statement on every deploy.

   Read chapter
2. 2

   Inherited browser sessions

   A Python tool in a hosted sandbox and browser control inside a user's own Chrome profile feel ordered by how much power each grants, and the order is backwards. The browser cannot execute anything and it acts as every service that profile is already signed into, with no authentication step to observe and no way to tell its actions from the human's. This chapter ranks two designs by authority rather than capability, and shows why containment means something different for each.

   Read chapter
3. 3

   Authority enumeration

   A susceptibility rate from an injection payload set moves with the model version, the system prompt and the payloads, and says nothing about what one successful steering reaches. This chapter runs the two-day exercise that does: sessions, local credentials, network position, exfiltration channels, destructive reach, then one end-to-end chain as proof — and shows how to write the finding so it changes a design instead of being acknowledged.

   Read chapter
4. 4

   Pricing a browser agent

   Three supplier portals with no API make a browser agent look inevitable until the alternatives are costed on the same outcome: a scraper per portal, twenty minutes of somebody's week, or asking the supplier for a feed. This chapter prices build, run, latency, maintenance and injection surface side by side, measures a screenshot loop's real token cost, and names the combination — unattended, write access to a system of record, no verification — that produces the incident.

   Read chapter
5. 5

   Verifying a completed run

   Checkpoints, idempotency, audit trails and kill switches all answer a task that stopped; none of them notices a task that ran to completion doing the wrong thing. This chapter builds the class of control that does — preconditions on the artefact's shape before any write, reconciliation against an independently obtained figure, a bounded blast radius per run, and an alert when a step's outcome stops matching its historical distribution.

   Read chapter
6. 6

   Default-deny and brokered credentials

   A page listing what agents may never do achieves nothing unless something in the call path answers no by default and every exception carries a scope, a named owner and an expiry that revokes. This chapter builds the credential broker that turns a policy into a mechanism, the grant record it evaluates, the category list worth defending, and the three monthly numbers that say whether any of it is working.

   Read chapter
7. 7

   Checkpoints and idempotent recovery

   An agent stopped halfway through renaming forty files and sending two emails leaves three questions — where it stopped, what already happened, whether re-running is safe — that cannot be answered afterwards without design work done earlier. This chapter builds the two-phase journal that bounds the ambiguity to one step, the probes that establish truth from the target system, the plan ordering that keeps irreversible actions last, and the kill switch that works when the agent does not cooperate.

   Read chapter