Claude's computer use beta needed a sandbox, not just a warning

A public beta that hands the model a mouse and keyboard

On 22 October 2024, Anthropic announced a public beta of 'computer use' in Introducing computer use, a new Claude 3.5 Sonnet, and Claude 3.5 Haiku: an upgraded Claude 3.5 Sonnet, first released in June 2024, could take a screenshot, move a cursor, click and type, letting a developer wire it into a standard desktop rather than a purpose-built API. The announcement calls it 'the first frontier AI model to offer computer use in public beta' and reports a score of 14.9% on the OSWorld benchmark's screenshot-only setting — a specific, attributed figure, not a general claim of proficiency. Anthropic's own framing is unusually candid: the capability is described as 'experimental — at times cumbersome and error-prone,' with tasks like scrolling, dragging and zooming named as still difficult for the model.

What the announcement warns about directly

The announcement states plainly that computer use 'may provide a new vector for more familiar threats such as spam, misinformation, or fraud,' and recommends that developers 'begin exploration with low-risk tasks.' It mentions that Anthropic was building classifiers to detect when computer use is happening and whether harm is occurring, but the announcement itself gives no technical isolation guidance — that detail sits in separate developer documentation, not the launch post.

What the sandboxing guidance actually requires

Anthropic's documentation, Computer use tool, current as retrieved on 16 September 2026, spells out what the announcement left implicit: a reference implementation running inside a Docker container, and an explicit warning to use 'a dedicated virtual machine or container with minimal privileges,' avoid exposing sensitive data such as login credentials, restrict internet access to an allowlist of domains, and require human confirmation before consequential actions. The documentation names the specific failure mode this defends against: 'Claude will follow commands found in content even when they conflict with your instructions' — meaning text or images the model sees on screen, not just the operator's own prompt, can steer its actions. Anthropic states it runs automatic classifiers over screenshots to catch this, but frames the four precautions above as the developer's own responsibility, not something the model's training alone resolves.

• Is the deployment running inside an isolated environment with the specific minimal-privilege configuration the documentation describes, or a general-purpose machine?
• Does the workflow expose the model to a login form, payment page, or other sensitive surface the guidance says to avoid?
• What OSWorld-style task most resembles the actual job the agent will perform, and does the reported 14.9% figure say anything about that specific task?

Giving a model a screen and a keyboard converts every rendering error, injected instruction, or misclicked button into an action with real consequences, rather than a wrong line of text. The gap between an announcement calling a beta 'experimental' and a docs page spelling out mandatory sandboxing is the gap between the marketing framing and the operating manual, and the second is the one to read before deployment.