Indirect prompt injection.
A computer-use agent reads the web to do its job. Hidden instructions on a page or in a document can hijack it, the same way a phishing email targets a person. The agent follows the attacker, not you.
For computer-use agentsContainment first
Run Claude computer usesafely.
Computer-use agents act on what they read. That makes prompt injection a real risk. Route browser work through an isolated session. Then minimize permissions and verify the boundary.
- Off-device browser work
- End the session
- Verify every permission
the boundaryREVIEW
ON MACHINE
Host scope
profile. files. credentials. network.
IN SANDBOX
Task scope
browser. selected sites. required credentials.
the boundary decides what a hijack reaches.
[ THE RISK ]
The risk, in plain terms.
A computer-use agent acts on what it reads. When the page is hostile, the agent can be too. The question is what it can reach when that happens.
Your machine is the blast radius.
Run an agent locally and it may inherit the permissions you grant. Browser profiles, files, credentials, and network access can expand the blast radius.
Persistence makes it worse.
Cookies and tokens left on disk can outlive the task. Retained state gives a later run more context and more authority than it may need.
The mechanism: read how indirect prompt injection hijacks an agent through content it reads, or the broader prompt injection explainer.
[ CONTAINMENT ]
How to reduce the blast radius.
Isolation does not stop an agent from being tricked. It separates browser work from your local browser profile. Permissions still decide what the agent can reach.
The browser task runs off your device.
Route the browser task through an isolated session off your device. Verify mounts, network access, and every external tool the agent can call.
Provide only what the task needs.
Keep your local browser profile outside the task. Verify cookie, credential, storage, and log retention in the exact environment you use.
Close the session and verify.
End the session when the task is done. Check what remains in storage, logs, credentials, and connected systems.
[ HOW TO USE IT ]
Add it. Route it.
Verify it.
Add the ready skill. Route browser work through the isolated session. Close it and verify what remains.
Add the agent skill.
Use Legba's ready skill for routing and isolated browser sessions. Check its requested permissions.
Route the browser task.
Run the browser step in the isolated session. Grant only the sites, credentials, and tools the task needs.
Close and verify.
End the session after the task. Check retention, logs, storage, and credential cleanup before production use.
Go deeper: see the full OpenClaw browser-isolation guide or the run OpenClaw safely guide.
[ OUTSIDE THE TASK ]
What to keep outside the task.
Credential scope.
Keep local keychains, environment secrets, and saved logins outside the task unless access is explicitly required.
Browser identity.
Use a separate browser session. Do not import a local profile unless the task and risk review require it.
Host resources.
Do not mount local files or expose internal network access unless the task requires them. Test every exception.
[ FAQ ]
Straight answers.
Does Legba stop prompt injection?
No. Indirect prompt injection can arrive through any content the agent reads. Isolation can reduce the blast radius when browser work runs off your device and permissions are scoped. Test credential access, mounts, network reach, logs, and retention directly.
What can the agent actually access?
Anything the environment and tool permissions expose. Inventory browser data, credentials, files, network destinations, and external tools. Deny everything the task does not need, then verify the boundary with a realistic test.
What happens to my credentials?
Scope credentials to the task. Do not expose your local browser profile or broad environment secrets. Verify how the session stores, logs, and removes any credential you provide.
Is this the same as running the agent in Docker?
No. Docker isolates a process according to your container configuration. Legba's ready agent skill provides browser routing and isolated browser sessions. Compare permissions, networking, mounts, observability, and retention for your use case.
Which agents can I run?
The ready skill is Legba's current public agent path. Confirm compatibility and requested permissions in your own OpenClaw environment before relying on it.
Where do I learn the full evaluation framework?
Read the practical guide on when to run an agent locally, when to contain it, and what to inspect first. It walks through the decision in plain terms and links back to the OpenClaw product page.
Use the internet without the internet using you.
Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.
Free for 30 days. No card required.
Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.