AI Agents Can Now Click, Type and Buy for You. Should You Let Them?

AI agents can now take screenshots, move the mouse, fill in forms and finish checkout flows on their own. Every major AI lab ships some version of this. The same vendors also publish unusually blunt warnings about how these agents can be hijacked. Here is what has shipped, what the documented risks are, and how to use these agents without handing over the keys.

What Has Actually Shipped

Anthropic: computer use and Claude in Chrome

Anthropic's computer use tool gives Claude "screenshot capabilities and mouse/keyboard control for autonomous desktop interaction." As of October 2026 it is generally available on the Claude API and Google Cloud, and in beta on some other cloud platforms (Anthropic computer use docs).

Separately, Anthropic introduced Claude in Chrome, a browser extension, in August 2025, and published its prompt-injection test results along with it (Anthropic, Claude in Chrome).

OpenAI: ChatGPT agent and Atlas

OpenAI's ChatGPT agent system card is dated 17 July 2025. It describes an agent with a visual browser, a terminal tool and Connectors to external data sources such as Google Drive (OpenAI, ChatGPT Agent System Card). OpenAI later added agent mode to its ChatGPT Atlas browser. eSecurity Planet's coverage of the Atlas security work notes that the agent can perform "many of the same actions a user can in a browser — sending emails, accessing cloud files, or completing transactions" (eSecurity Planet, Dec 29, 2025).

Google: Gemini Computer Use

On 7 October 2025 Google released the Gemini 2.5 Computer Use model in public preview through the Gemini API. Google described it as "primarily optimized for web browsers" and "not yet optimized for desktop OS-level control" (Google, Oct 7, 2025).

The Core Risk: Anything on the Screen Can Talk to the Agent

A chatbot only reads what you type into it. A computer-use agent reads everything it sees, including web pages, emails, PDFs and images, and some of that content may have been written by an attacker. OWASP calls this indirect prompt injection: the model "processes external sources like websites or files containing content that alters model behavior" (OWASP LLM01:2025).

The vendors say this plainly in their own documentation:

• Anthropic: "In some circumstances, Claude will follow commands found in content even when they conflict with your instructions. For example, instructions on webpages or contained in images might override your instructions" (Anthropic).
• OpenAI: prompt injections can lead to "exfiltrating data (for example from a Connector, or another site that the user has logged ChatGPT agent into), taking actions the user didn't intend, or simply providing the user an incorrect answer" (OpenAI system card).
• OpenAI, on Atlas: "Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully 'solved,'" as quoted by Techloy (Dec 23, 2025).

How often do attacks work?

Anthropic published numbers for Claude in Chrome. Across "123 test cases representing 29 different attack scenarios," the attack success rate was 23.6% before new mitigations and 11.2% after them in autonomous mode. On a challenge set of four browser-specific attack types, success fell from 35.7% to 0%. One successful attack was a fake email asking the agent to delete messages "for mailbox hygiene," which it initially did without checking with the user (Anthropic).

The takeaway isn't that agents are useless. It's that model-level defenses lower the risk without removing it, so you need controls outside the model too.

What the Vendors Built In

• Confirmations: OpenAI trained ChatGPT agent "to ask the user for confirmations before finalizing actions that affect the state of the world (e.g., before completing a purchase or sending an email)."
• Watch mode: In sensitive contexts such as a logged-in email or banking account, ChatGPT agent pauses when the user becomes inactive or navigates away.
• Refusals: The agent is meant to refuse certain high-stakes financial tasks, "such as making financial account transfers," and OpenAI disabled memory at launch to reduce the risk of data being exfiltrated from it (OpenAI system card).
• Classifiers: When the computer use tool is enabled, Anthropic's classifiers scan tool output such as screenshots for possible injections. They steer Claude to check with the user before acting on suspicious instructions (Anthropic).
• Per-step checks: Google runs an "out-of-model, inference-time safety service that assesses each action the model proposes before it's executed." Developers can also require the agent to refuse or to ask for confirmation before high-stakes actions (Google).

Seven Rules Before You Let an Agent Drive

These rules come straight from vendor documentation and OWASP's guidance on prompt injection and "Excessive Agency":

1. Sandbox it. Anthropic recommends "a dedicated virtual machine or container with minimal privileges" (Anthropic).
2. Keep credentials away from the agent. Avoid "giving the model access to sensitive data, such as account login information."
3. Allowlist domains. Limit internet access "to an allowlist of domains to reduce exposure to malicious content."
4. Require approval for consequential actions. Anthropic lists "completing financial transactions, or agreeing to terms of service" as examples. OWASP says to "require a human to approve high-impact actions before they are taken" (OWASP LLM06:2025).
5. Grant the least privilege needed. OWASP's root causes of excessive agency are "excessive functionality," "excessive permissions" and "excessive autonomy." Limit each one.
6. Enforce authorization outside the model. OWASP recommends doing authorization in downstream systems rather than relying on the LLM to decide what's allowed.
7. Separate and label untrusted content, and log everything. OWASP's prompt injection guidance recommends segregating external content and adversarial testing. Monitoring and rate limits limit the damage when something gets through (OWASP LLM01:2025).

If you want a broader framework, OWASP's GenAI Security Project released the OWASP Top 10 for Agentic Applications on 9 December 2025. It is a peer-reviewed list of the most critical risks for autonomous AI systems, built with more than 100 contributors (OWASP).

So, Should You Let Them?

Yes, for low-stakes, reversible tasks in a sandbox: research, form-filling on test accounts, collecting data from public pages. Not yet, unsupervised, for anything that moves money, sends messages in your name or deletes data. For those, the agent should do the work and stop before the irreversible step so a human can approve it.

Before reaching for a screen-driving agent at all, check whether the job can go through an API. A structured API call such as "send this Slack message" or "create this calendar event" exposes far less to injected content than an agent reading arbitrary web pages.

How MultiverseAI Approaches This

MultiverseAI follows the API-first approach. Its 88 agent tools act through 50 integrations connected with your own accounts, so they work through scoped service connections rather than by clicking around a screen. Approval gates pause an agent before it posts, sends or deletes, which is the human-approval control OWASP and the vendors recommend. In the visual Workflow Builder you can see exactly which tools each step can use before a schedule, webhook or chat trigger fires it.

Want agents that ask before they act? Start free with 100 credits or see how approval gates work.

Sources

1. Anthropic, "Computer use tool," Claude Platform Docs. https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool
2. Anthropic, "Claude in Chrome" (blog post), Aug 25, 2025 (updated Dec 18, 2025). https://claude.com/blog/claude-for-chrome
3. OpenAI, "ChatGPT Agent System Card," July 17, 2025. https://cdn.openai.com/pdf/839e66fc-602c-48bf-81d3-b21eacc3459d/chatgpt_agent_system_card.pdf
4. Google, "Introducing the Gemini 2.5 Computer Use model," Oct 7, 2025. https://blog.google/technology/google-deepmind/gemini-computer-use-model/
5. eSecurity Planet, "OpenAI Hardens ChatGPT Atlas Against Prompt Injection Attacks," Dec 29, 2025. https://www.esecurityplanet.com/artificial-intelligence/openai-hardens-chatgpt-atlas-against-prompt-injection-attacks/
6. Techloy, "OpenAI admits prompt injection isn't going away as it hardens security for Atlas," Dec 23, 2025. https://www.techloy.com/openai-admits-prompt-injection-isnt-going-away-as-it-hardens-security-for-atlas/
7. OWASP GenAI Security Project, "LLM01:2025 Prompt Injection." https://genai.owasp.org/llmrisk/llm01-prompt-injection/
8. OWASP GenAI Security Project, "LLM06:2025 Excessive Agency." https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
9. OWASP GenAI Security Project, "OWASP Top 10 for Agentic Applications for 2026," Dec 9, 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/