---
title: "Run browser and computer-use agents in a · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-features/agents-in-products/isolated-browser-agents
id: AIF-74
level: Recommended
applies: ai-features
updated: 2026-10-27
build: a2a6bdfed830
tokens: 867
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run browser and computer-use agents in a throwaway session

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AIF-74
- Level: Recommended
- Chapter: [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md)
- Rule: Run each browser or computer-use agent in a fresh, isolated browser profile or virtual machine with no saved logins. Limit it to listed domains, and ask the user before it submits a purchase, a message or terms.
- Check: A test page with a hidden instruction to open a domain off the list is loaded in a run. The request to that domain is blocked. A new run starts with no cookies and no saved passwords, and a checkout form pauses the run for approval.
- Applies when: The project uses AI models.
- How: An agent that reads web pages reads text from anyone, and a page can tell it to go elsewhere or type in secrets. Start each run from a clean image with minimal rights, and destroy it at the end. Give it only the logins the task needs, for that run. Block every domain not on the task's list at the network layer, not in the prompt. Pause before any form that pays, sends, deletes or agrees to terms, as [ask a person before an agent does what cannot be undone](https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-approval-irreversible.md) requires. Tell users what the agent can do before they turn it on.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### TypeScript example

```ts
const context = await browser.newContext({ storageState: undefined });
await context.route('**/*', route => (allowedHosts.has(new URL(route.request().url()).hostname) ? route.continue() : route.abort()));
```

### Python example

```python
context = browser.new_context(storage_state=None)
context.route("**/*", lambda route: route.continue_() if urlparse(route.request.url).hostname in ALLOWED_HOSTS else route.abort())
```

## Sources

- [Claude Docs, computer use tool security considerations](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool)
- [OWASP LLM01:2026 Prompt Injection](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md)

## Related rules

- AIF-70 [Ask a person before an agent does what cannot be undone](https://agentwranglers.se/playbook/ai-features/agents-in-products/agent-approval-irreversible.md) in AI features

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-features/agents-in-products/isolated-browser-agents">Agent Wranglers AI features playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Connect product agents only to tools and servers on a reviewed list](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md)
- [Agents in products](https://agentwranglers.se/playbook/ai-features/agents-in-products.md)