Containment for Computer-Use: Sandboxes, Action Gates, Human-in-the-Loop, and Reversibility

Everything about a computer-use agent pushes toward the same conclusion: its exposure is structural and cannot be prompted away. The display it reads is untrusted, the grounding step that turns intent into a click is unreliable even without an adversary, the action space it operates is whatever software it can reach, and the environment it works in can inject instructions, distractors, and hostile applications through many surfaces at once. Each of those is a reason some manipulations will succeed. The mature response is not to chase a perfect defense that prevents every bad action — no such defense exists for an agent that must read and act on arbitrary screens — but to build containment: an architecture that accepts that bad actions will occasionally happen and guarantees that when they do, they reach as little as possible and can be undone. This piece assembles that architecture in full. It takes the perception, grounding, and action problems a computer-use agent faces and answers them with four families of control — sandboxing, gating, human oversight, and reversibility — composed so that no single failure becomes an incident.

Why Containment, Not Prevention

Prevention aims to stop every manipulation; containment aims to bound every consequence. For a computer-use agent, prevention is not achievable, because the capabilities that make the agent useful — reading arbitrary screens, grounding to elements, acting over open-ended software — are exactly the capabilities an attacker abuses, and removing them removes the agent. Grounding is unreliable even with no adversary present, the display is untrusted by construction, and the environment reaches the agent through surfaces no filter fully covers. A defense premised on catching every bad action will therefore leak.

Containment starts from the opposite assumption. It takes as given that some manipulations will succeed and asks a different question: when a bad action fires, how small can its effect be, and how quickly can it be undone? This reframes security from a wall around the agent into a set of limits on what any single action can reach, which is a goal that is actually attainable for a system whose inputs cannot be fully trusted.

The rest of this article builds that set of limits. It is deliberately layered, because the attacker's moves are interchangeable — a bent grounding, an injected instruction, a hostile application all lead to the same place — and a single control rarely covers all of them. Containment is defense in depth applied to an agent that acts in the world.

The Containment Stack

The controls organize into a stack mapped onto the agent's loop, each layer bounding a different part of the path from hostile input to harmful effect. At the base is the sandbox: the environment the agent runs in, shrunk to a minimal, known set of applications, files, and destinations, so the reachable world is small before anything else acts. Above it, provenance at perception marks which content is the genuine task and demotes everything else to untrusted data, and corroborated grounding requires the visual, structural, and semantic channels to agree before a consequential action, so a bent grounding is caught.

Higher still, the action gate interposes on the act stage, classifying every action by reversibility, type, and target and permitting, gating, or blocking it. At the top, reversibility and human oversight make failure survivable: irreversible actions are gated to a human or replaced by reversible substitutes, and the system can roll back. No layer is sufficient alone — a sandbox still trusts the software inside it, a gate still passes reversible actions — but each closes a link the others leave open.

The value of naming the stack is that it turns a pile of individual defenses into an architecture with coverage. A defender can point to each layer and say which attacker move it stops: sandboxing bounds the blast radius, provenance stops content-as-instruction, corroboration stops grounding attacks, the gate stops consequential hijacks, and reversibility undoes what slips through. Gaps become visible as missing layers rather than hiding as untested assumptions.

Sandboxing: Shrinking the World the Agent Can Touch

The sandbox is the foundation because it bounds the blast radius before any action is even considered. Running the agent in an isolated environment with only the applications, files, and network destinations the task requires means that even a fully hijacked agent can reach only that small set. Ephemeral, disposable environments strengthen this further: an agent that operates in a fresh, throwaway sandbox leaves no standing state for an attack to persist in, and any damage is discarded with the environment.

Least privilege is the principle throughout. The agent's session should carry the minimum credentials and permissions the task needs, no standing access to systems outside the task, and no ability to reach high-consequence destinations that the work does not require. This directly attacks the standing-privilege amplifier: an action can only do as much as the session it runs in permits, so a small session bounds a large mistake.

Sandboxing does not make the software inside the sandbox trustworthy — a hostile application placed inside is still hostile — which is why it is a foundation and not a complete defense. Its job is to make the worst case small, so that the layers above it are protecting a limited surface rather than the open world.

Action Gates: Interposing on the Act Stage

The action gate is the single choke point where policy meets the world. It sits between the agent's decision and the real interface, and every action passes through it before becoming an effect. For each action it computes the attributes that decide its risk — is this reversible, is it an allowed type for the task, is its target in the expected set — and it permits, gates, or blocks accordingly. Reversible, in-scope actions flow freely; irreversible or out-of-scope actions are stopped or escalated.

Interposition is what makes the gate powerful. Because the agent cannot reach the interface except through the gate, there is no path around it: a hijack that produces a consequential action still has to present that action to the gate, where its irreversibility and target are evaluated independently of the agent's compromised reasoning. The gate does not trust the agent's judgment that an action is fine; it applies external policy to the action itself.

This is also where the containment stack becomes enforceable rather than advisory. Provenance, corroboration, and reversibility classification all feed the gate's decision, and the gate is the component that acts on them. A design without a real choke point leaves those upstream signals as suggestions the agent can ignore; a design with one makes them binding.

Human-in-the-Loop: Oversight Where It Counts

Human oversight is powerful but expensive, so containment spends it precisely where it matters: before irreversible, high-consequence actions, not as general monitoring of everything the agent does. A human asked to review every click will approve reflexively and add no safety; a human asked to authorize only the handful of consequential, irreversible actions in a task is a meaningful backstop, because those are the actions where a wrong decision cannot be undone.

Placement is the whole game. Oversight after an irreversible action has already fired is not oversight; it is an incident report. The human gate must sit before the action, in the path the action gate enforces, so that the agent's speed is throttled to human review exactly and only at the irreversible steps. Everywhere else the agent runs at full autonomy, doing the large volume of reversible work that carries no lasting risk.

Making oversight feasible is a design responsibility. The system should batch and automate the reversible majority, surface only the decisions that genuinely require judgment, and present each with the context a human needs to decide quickly. Oversight that is too frequent or too context-poor collapses into rubber-stamping, which is why the action classification that identifies the truly consequential actions is a prerequisite for effective human-in-the-loop.

Reversibility by Design: Making Failure Survivable

Reversibility is the deepest lever because it changes the worst case instead of trying to prevent it. When the operations available to the agent are undoable — drafts instead of sends, staging instead of committing, dry-runs instead of live execution, snapshots that permit rollback — a hijacked action lands somewhere recoverable, and the incident becomes an inconvenience. Designing the agent's action repertoire to favor reversible operations is often more effective than any detection, because it protects even against the manipulations no one anticipated.

Where the platform offers no reversible path, that fact is itself a signal: the action is exactly the one that most deserves a human gate, because there is no recovery behind it. Reversibility and human oversight are therefore complementary — the reversible majority runs freely, and the irreversible minority is gated — and together they cover the space of actions with proportionate cost.

Reversibility also buys time, which is the scarce resource against an autonomous agent. Checkpoints and rollback mean that even a burst of bad actions can be reverted once a circuit breaker or a human notices, so the agent's speed stops being an unrecoverable liability. A system that can always return to a known-good state has converted irreversibility, the property that makes computer-use agents dangerous, into something it can manage.

Composing the Layers: Defense in Depth

The layers earn their keep by covering each other's gaps. The sandbox bounds how much any action can reach but does not stop a hostile action within its walls; the action gate stops consequential actions but passes reversible ones; corroborated grounding catches a bent landing but not a hostile application flow; reversibility undoes damage but does not prevent it. Each control has a hole, and the holes do not line up, so an attacker move that slips past one layer meets another.

This is why containment is composed rather than singular. An injected instruction that survives provenance still faces a corroboration check at grounding, an action gate at the act stage, and reversibility behind that; a grounding attack that survives corroboration still faces the gate and the sandbox's bounded reach. The attacker needs to defeat every relevant layer in sequence, while the defender needs only one layer to hold, which inverts the usual asymmetry in the defender's favor.

Residual risk remains, and honesty requires naming it. Containment reduces the probability and the severity of harm; it does not eliminate them, and a determined attacker with a novel move may still find a path. The goal is not a guarantee but a posture in which single failures are survivable and catastrophic outcomes require multiple simultaneous failures — which is the strongest position available for an agent that must act on untrusted input.

A Reference Containment Architecture

Assembled, the architecture reads as a pipeline wrapped in a boundary. The agent runs inside a sandbox that exposes only the task's applications and destinations. Its perception is provenance-marked, so the genuine task is separated from untrusted screen content. Its grounding is corroborated across channels before any consequential action. Every action it proposes passes through an action gate that classifies it by reversibility, type, and target. Irreversible actions are routed to a human gate; the rest, if reversible and in scope, proceed. Reversibility and checkpoints stand behind everything, and a monitor with circuit breakers watches for anomalous bursts and halts the agent when the pattern does not match the task.

Each component maps to a specific way the agent is exposed. The sandbox answers the unbounded action space and standing privilege; provenance answers content-as-instruction; corroboration answers grounding attacks; the gate answers action hijack; the human gate and reversibility answer irreversibility and autonomy; the monitor answers the speed that outruns oversight. The architecture is not a list of nice-to-haves but a direct response to a specific threat model, with one control for each way the agent is exposed.

This reference is deliberately product-agnostic. It describes control functions and their placement, not any vendor's implementation, so it applies to any screen-driven agent regardless of the model or platform underneath. A team can implement each function however their stack allows, as long as the choke point is real, the sandbox is genuinely isolating, and the human gate sits before the irreversible action rather than after it.

The Takeaway for the AI-Agent Stack

Containment is what makes a computer-use agent deployable rather than merely demonstrable. The capability is real and valuable, but its exposure — untrusted display, unreliable grounding, open-ended action, hostile environment — is intrinsic, so the responsible way to ship it is to bound its failures rather than to pretend they will not happen. The OWASP Agentic guidance's central worry, excessive agency, is answered here not by trusting the agent to behave but by architecting the environment so that even a misbehaving agent cannot do lasting harm.

The portable stance is to treat every screen-driven agent as a system that will occasionally be manipulated and to design so that manipulation is survivable: sandbox the world it touches, mark the provenance of what it perceives, corroborate where it acts, gate the actions that matter, keep a human before the irreversible ones, and make everything reversible that can be. None of these is exotic; together they convert an inherently exposed capability into one whose worst day is recoverable.

The single idea to carry is this: you cannot make a computer-use agent's inputs trustworthy, so make its failures survivable. Containment — sandboxes, gates, human oversight, and reversibility, composed in depth — is the discipline that does exactly that.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

for each proposed_action:
  a = classify(proposed_action)      # reversible? type? target?
  if a.target not in expected_targets(task): block
  elif a.irreversible: route_to_human_gate
  elif a.type in allowed_types(task): permit
  else: block
# upstream signals feed classify(): provenance, channel_agreement
monitor: circuit_break on burst OR task_mismatch
recovery: checkpoint before permit; rollback on alarm

sandbox:
  lifetime: ephemeral            # disposed after task
  allowed_apps: [task-portal]
  allowed_egress: [task-portal.internal]
  credentials: least_privilege   # no standing access
  filesystem: task_scratch_only
  everything_else: unreachable

Glossary

Containment

A security posture that bounds and reverses the consequences of manipulations rather than trying to prevent all of them.

Sandbox

An isolated environment exposing only the applications, files, and destinations a task requires, ideally ephemeral and least-privilege.

Action gate

An external policy enforcement point between the agent's decision and the interface that classifies and permits, gates, or blocks each action.

Human-in-the-loop

Human authorization placed before irreversible, high-consequence actions rather than as general after-the-fact monitoring.

Reversibility by design

Structuring the agent's action repertoire to favor undoable operations so a hijacked action lands somewhere recoverable.

Defense in depth

Composing controls with non-aligned gaps so an attacker must defeat every layer while the defender needs only one to hold.

References

1. Xie, Zhang, Chen et al., OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments (arXiv 2404.07972, NeurIPS 2024)
2. Zhou, Xu, Zhu et al., WebArena: A Realistic Web Environment for Building Autonomous Agents (arXiv 2307.13854, ICLR 2024)
3. Zhang, Yu & Yang, Attacking Vision-Language Computer Agents via Pop-ups (arXiv 2411.02391, ACL 2025)
4. Greshake, Abdelnabi, Mishra et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173, 2023)
5. OWASP Agentic Security Initiative
6. OWASP Top 10 for LLM Applications
7. MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
8. NIST AI Risk Management Framework (AI RMF 1.0)