AI Agent Security: Is Computer Access Safe?

01 / The story

What changes when AI can use your computer?

An agent that can browse, open files or execute commands has authority beyond writing an answer. It can see information you did not intend to share, change a file or send a message through a signed-in account. The risk follows the granted capability, not whether the interface calls itself a chatbot, assistant or agent. [1]

There is no universal yes-or-no safety verdict. Reading a public manual in a disposable browser is different from working in your normal browser with payroll, email and cloud administration tabs open. Begin by listing accessible files, accounts, tools and outbound destinations. Then decide which of those the task truly needs.

This guide focuses on desktop and browser exposure. Our financial-permissions guide covers the separate approval rules for moving money.

02 / The story

Seven risks and the controls they need

The following is Qlauson’s grouping of risks described in OWASP guidance, not a reproduction of its official ten-category framework. OWASP’s Agentic Top 10 for 2026 was released in December 2025; it is not a new October announcement. [1] [2]

A model’s refusal is useful behavior, but it is not an access-control boundary. An application should reject an unauthorized tool call even if the model confidently requests it. Controls must handle ordinary mistakes as well as deliberately misleading external content.

03 / The story

How a page can redirect an agent

Indirect prompt injection occurs when outside content tries to redirect the agent away from the user’s request. That content might be an email, retrieved document, website or tool description. Encountering it does not automatically prove a compromise: harmful results depend on what the agent follows and what its tools permit. [1]

Consider an illustrative scenario: you ask an agent to compare supplier documentation. One page says verification requires uploading a local folder. That is a request from the page, not permission from you. An agent with access to that folder and unrestricted uploads could cross a trust boundary.

Folder restrictions prevent reading unrelated files; outbound restrictions reduce where data can go; an independent disclosure approval checks the actual file and destination. None makes all prompt injection disappear, but together they limit what a misleading instruction can achieve. The scenario is not a reported incident or a claim about a named product.

04 / The story

Read-only access is a starting point, not a privacy guarantee

Read-only tools reduce modification risk. They can still reveal confidential data to the model, a remote service, a generated answer or another permitted communication tool. A browser session can expose personal information without changing the page at all. [1]

Use a separate agent identity, a narrow folder and a separate browser profile. Avoid reusing an administrator account. If the task needs one source file, do not expose a whole home directory. If the agent needs one website, consider a destination allowlist rather than unrestricted network access.

Credential handling matters as much as file permissions. Prefer a controlled service that uses a narrowly scoped credential on the agent’s behalf. Do not paste a production secret into the conversation to make a connector work. Protect logs too: a detailed audit trail is harmful if it becomes a second copy of private tokens.

05 / The story

What a sandbox does—and what it does not

A sandbox is an isolated execution environment designed to limit effects outside its boundary. It helps when generated code fails or an agent attempts an unexpected command. But connected accounts, shared folders and unrestricted network access can still expose valuable assets. [1]

Map the connections leaving the sandbox. A disposable computer signed into a production email account still has production authority. A container with a sensitive directory mounted inside it can still read that directory. “Sandboxed” therefore needs a description of what is isolated, not just a reassuring label.

For unfamiliar integrations, review the source, maintainer and update process before installation. An MCP connector is code with permissions, not automatically trusted because it uses a standard protocol. Our MCP explainer separates compatibility from trust.

06 / The story

Make approvals about the exact action

Require explicit review before destructive changes, external communications, spending, privilege changes or sensitive disclosures. Show the real target, operation and relevant contents. A friendly model summary such as “clean up old files” is not enough to authorize a specific deletion. [1]

Bind approval to those details. If the target or contents change, obtain a new approval. Enforce the decision in the service performing the action rather than asking the model to remember it. This is a defensive design recommendation, not a guarantee that a product already implements it.

Stop conditions should also be enforced: maximum actions, time and budget; repeated failures; unexpected requests for credentials; and attempts to reach an unapproved destination. Make it possible for a person to interrupt and revoke access without waiting for the agent to agree.

07 / The story

What to record and test before a real rollout

Record the requesting identity, tool, action, authorization, approval, result and error. Avoid unnecessary personal content and never log credentials. Separate a proposed action from a completed one so reviewers can tell what actually happened. [1]

Test benign but disallowed requests in a non-sensitive environment: access outside the approved folder, an external send without permission, a changed action after approval and work beyond the limit. Verify that enforcement rejects them, rather than merely that the model says it would stop.

Include recovery. Check that revoking the identity stops further tool access and that a partial failure is visible. Backups help recover files but do not reverse a disclosed secret or unsend a message. A rollout decision should account for irreversible effects, not only successful demonstrations.

08 / The story

Who should start small—and when to keep humans in control

Personal users can begin with public research and local non-sensitive samples. Businesses should establish an owner, access policy, monitoring and incident process before connecting customer or staff data. High-impact legal, medical, financial and administrative decisions need qualified human oversight.

We reviewed guidance, not a product penetration test. No vendor safety ranking or compromise rate is established here. A safer deployment is one where authority stays narrow and a wrong instruction cannot automatically become a harmful action.