Computer-use tool without a visible sandbox
What it finds
The agent is given a computer-use tool (control of a mouse, keyboard, and screen) with no sign it runs in an isolated VM or container.
Why it matters
A computer-use agent acts with whatever the session can reach. On a real desktop that includes logged-in accounts, files, and saved passwords — and on-screen text can steer it.
What an attacker could do: Instructions on a web page or document could make the agent click, type, or download things on a real machine.
How to fix it
Run computer-use agents only inside a dedicated VM or container with no personal accounts or credentials, an allowlist of sites, and human confirmation for purchases, logins, and sends.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- COMPUTER_USE_UNSANDBOXED
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Agent source using the named framework (LangChain, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, computer-use tools)
- OWASP LLM Top 10
- LLM01 - Prompt Injection, LLM08 - Excessive Agency
- NIST AI RMF
- MG-2.2, MS-2.3
- SOC 2
- CC6.1, CC6.8
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High