Phase 6: Computer Use & Browser Agents · 55 min · Python · Playwright · Docker (conceptual)

Sandboxing & Safety for Browser Agents

Power without constraints is a security incident waiting to happen.

Hiring signal: Safety engineering for browser agents is a nascent but critical skill. Companies building autonomous agents that interact with the web — legal research tools, competitive intelligence platforms, QA systems — need engineers who think about threat models, not just happy paths. A candidate who proactively addresses prompt injection and sandboxing signals maturity.

What you will learn

Implement browser sandboxing: isolated environments, network restrictions, resource limits
Apply safety controls: action allowlists, forbidden URL patterns, human confirmation gates
Design computer use systems that are safe by default

The Problem

Your browser agent can browse the web, fill forms, and click buttons. This is powerful — and dangerous.

A malicious website could display hidden instructions that trick the agent into submitting forms, exfiltrating data, or visiting attacker-controlled pages. Without sandboxing, the agent operates in your real browser with your real cookies and credentials. Without action controls, it can take irreversible actions — create accounts, make purchases, send emails — without confirmation.

Sandboxing isolates the agent's environment. Safety controls limit what it can do even if it's tricked.

Browser Sandbox Architecture

A properly sandboxed browser agent runs in an isolated environment:

User Request
     │
     ▼
┌─────────────────────────────────────────┐
│           AGENT SANDBOX                 │
│  ┌─────────────┐    ┌────────────────┐  │
│  │  Claude API │    │ Playwright     │  │
│  │  (reasoning)│◄──►│ Browser        │  │
│  └─────────────┘    └────────────────┘  │
│         │                  │            │
│         │           ┌──────▼──────┐     │
│         │           │ Network     │     │
│         │           │ Filter      │     │
│         │           │ (blocklist) │     │
│         │           └──────┬──────┘     │
└─────────┼──────────────────┼────────────┘
          │                  │
   Safety Gate          Internet
   (confirm gate)       (filtered)
          │
     Human User

Key isolation properties:

No access to local filesystem — no file:// URLs, no native file pickers, no downloads to system paths
Network filtered — blocklist for known malicious domains; optionally allowlist for only approved domains
Session isolated — no cookies or credentials from the user's real browser profile
Resource limited — maximum session duration, CPU/memory caps prevent runaway agents
Clean profile — fresh browser profile per session (no stored passwords, no browser history)

Anthropic's reference implementation uses Docker + Playwright + a network proxy for the first three.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Action Safety Controls, Prompt Injection in Browser Contexts, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.