Claude computer use red-team: autonomous agent browses to attacker-controlled site and follows instructions
Date: 2024-10
Affected: Claude computer use beta — user's local machine
Attack vector: indirect-prompt-injection
Category: red-team
Severity: Critical

During Anthropic's red-team evaluation of Claude's computer use capability, testers demonstrated that the agent could be directed to browse the web, encounter attacker-controlled web pages containing prompt injections, and follow the injected instructions to perform unintended actions on the user's computer. The attack chain: user asks agent to research a topic → agent browses to malicious site → site contains hidden instructions → agent executes actions on the local machine.

Impact: Demonstrates fundamental challenge of computer-use agents: any browsing creates indirect injection surface

Mitigations:
Sandboxed execution environment for computer-use agents
User confirmation before any system-modifying actions
Content sanitisation for web content processed by agents
Domain allowlisting to restrict agent browsing scope

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Agent has computer control capabilities (keyboard, mouse, browser)
role: origin
label: Agent Ecosystem
notes: External web content contains indirect prompt injections
role: propagation
label: Deployment & Infrastructure
notes: Agent executes attacker's instructions on user's local machine
role: impact