Is It Safe to Let AI Control Your Computer?

The honest answer

Safe is not a property of the technology, it is a property of the setup. A computer-controlling agent scoped to one application, gated on consequential actions, and logged step by step is a reasonable thing to run on a work machine. The same agent handed an unscoped session with saved logins to everything and no approval gates is a genuinely bad idea, and no vendor claim changes that.

This deserves more care than most software decisions because of the shape of the risk. Ordinary software fails inside its own boundaries. An agent that reads a screen and acts on what it finds has a boundary defined by what happens to be visible, which is a much less predictable line.

The good news is that the controls are well understood and none of them are exotic. They are the same instincts you already apply to a contractor's laptop access: give the minimum, require sign-off on the expensive things, write the rules down, and check the logs. The rest of this page is those instincts made specific.

What the agent can actually see

It sees what the session and its permissions allow. In practice, on an unscoped setup, that means whatever is on the screen it captures: the app it is working in, but also open browser tabs, notifications that pop up, documents left open, and anything else already running under the same login.

That is not a flaw in any particular product, it is how screens work. A screenshot does not distinguish between the invoice portal you asked about and the email preview that slid in over it. Which is why the first and most effective control has nothing to do with the AI at all: control what is on the machine and what is open on it.

Visual prompt injection, the risk people miss

The specific attack worth understanding is visual prompt injection: instructions planted where the agent will read them, written for the agent rather than for you. A line of text in a web page, a filename, a document footer, a chat message, a notification banner. The agent reads the screen, and the planted text is on the screen, so it enters the reasoning like everything else.

This is measured, not theoretical. In a published benchmark of 306 interactive test cases across five widely used platforms, injections steered computer-use agents successfully up to 51 percent of the time, and browser-only agents up to 100 percent on some sites. Conversational surfaces like email and messaging were among the worst, with attempted rates frequently above 40 percent. Injecting early or late in a task made little difference, and system prompt defences alone produced only limited improvement.

Governments have landed in the same place. Security agencies across the Five Eyes published joint guidance on agentic AI in 2026 naming prompt injection as a core route for manipulating agents, and stressing that no single safeguard is sufficient on its own. Anyone offering you a one-line fix for this is selling something.

The five controls that actually work

None of these is clever, and that is the point. Layered ordinary controls beat a single sophisticated one, because the failure modes are varied enough that no single defence covers them.

• Scope per app, never per machine. Give the workflow the one application it needs. Most incidents in this category involve access the task never required in the first place.
• Gate everything irreversible. Payments, credential entry, deletions, and anything leaving your network waits for a human yes. Permanently, not just during the first week.
• Bind rules to the tool, not the conversation. "Never run commands outside this directory" attached to the tool holds on run four hundred. The same sentence in a chat message does not.
• Read the activity log. Screenshots and action traces are only a control if somebody opens them. Daily during the ramp, then spot checks.
• Treat screen content as untrusted input. Assume any text the agent reads may be aimed at it, and never let a workflow act on an instruction it found rather than one you gave.

Notice that four of the five are configuration rather than technology. That is genuinely encouraging, because it means the safety of your setup is mostly in your hands rather than dependent on a model getting better. It also means a product that does not give you those knobs is harder to run safely regardless of how good its underlying agent is.

There is also a case for who holds the access, not just how much. A dedicated AI Employee that owns one workflow can be given exactly the tools that workflow needs and nothing else, and everything it does stays attributable to it. That is a cleaner security posture than a general-purpose assistant accumulating permissions over time because each individual request seemed reasonable. Scope creep is as real for agents as for people.

How this works on Sistava

Each of the five controls maps to something you can switch on rather than a promise. Tools are enabled or disabled per employee, so an employee that never needs desktop access never has it. Tool Rules let you write plain-English constraints that bind a specific tool on every run. Approval gates hold consequential actions until you release them, and the request shows you exactly what is about to happen before it happens.

Every action then lands in the activity feed with a screenshot, so reviewing a run means scrolling through what actually appeared on screen rather than reading a log line that claims what happened. That is the difference between an audit trail and an audit trail somebody will actually use, and it is what makes a wrong click something you catch on Monday rather than discover at quarter close.

None of this makes a screen-level agent risk-free, and we would rather say so plainly than pretend otherwise. What it does is keep the blast radius small enough to reason about and every action reviewable after the fact. That is the bar worth holding any product in this category to, including ours.

The safe first setup

What to do before the first unattended run

1. Choose the machine deliberately — Ideally one that stays on with only the apps that workflow needs. Not the laptop with your personal email and password manager open.
2. Enable the tool on exactly one employee — The one that owns this workflow. Leave desktop access off everywhere else until a second workflow genuinely needs it.
3. Write the tool rules first — Bound the directories, name the things it must confirm before doing, and state what it must never touch. Do this before the first run, not after the first surprise.
4. Keep gates on the whole first week — Approve every file change, submission, and outbound message by hand while you learn what the workflow actually does.
5. Read every run for a week — Open the activity feed and look at the screenshots. You are checking for actions you did not expect, not just for the right final result.

After that week you will know whether this workflow is boring, and boring is the target. A workflow that has run twenty times with no surprises is one you can release gates on, one step at a time, keeping them permanently on anything touching money, credentials, or an outside inbox.

If you are evaluating options in this category, the questions to ask any vendor are the same five: can I scope this to one application, can I gate irreversible actions permanently, can I attach rules to the tool itself, can I see a screenshot of every action, and what happens when a page tries to instruct the agent. A product that cannot answer all five is one you would have to build the safety around yourself.

The summary is short. This is not a technology to either trust or refuse, it is one to configure. Scope it to one job, gate the things you cannot undo, write the rules where they stick, and read the log while it is still new. Do that and the risk lands somewhere between reasonable and boring, which is the only place worth operating from.

For context beyond security, the full guide to AI computer control covers when this is the right tool at all, the mechanics write-up explains the loop it runs, and the no-API playbook walks through shipping your first workflow safely.