# What is computer use?

Computer use is an AI model operating a desktop the way a person does: it reads screenshots and answers with clicks, key presses and typing.

**Runtime gives a computer-use agent a Linux desktop inside its own microVM,
driven from the SDK, with a private live view and MP4 recording.** Anthropic's
documentation tells developers to run computer use in "a dedicated virtual
machine or container". It also says to limit internet access to an allow list.
A Runtime sandbox is both, and its rules are enforced outside the machine
([security](/docs/security)).

## How it works

In Anthropic's API, computer use is a client toolset. The model returns tool
calls such as `screenshot`, `left_click` or `type`. Your application performs
each one on a real screen and returns the result: a screenshot as an image, or
a short acknowledgment. The model then decides the next action. Anthropic lists
it as generally available on the Claude API and Google Cloud, with the
`computer_toolset_20260801` version. The loop is the ordinary
[agent loop](/glossary/agent-loop), with pixels as the feedback.

## Anthropic's precautions, and Runtime's answer

| Anthropic's recommendation                          | On Runtime                                                            |
| --------------------------------------------------- | --------------------------------------------------------------------- |
| A dedicated VM or container, minimal privileges     | A Firecracker microVM per sandbox; root there controls only the guest |
| Keep sensitive data, such as logins, from the model | Secrets the sandbox never holds; the proxy adds them for named hosts  |
| Limit internet access to an allow list of domains   | Per-sandbox `allow` lists, or internet off, applied immediately       |
| A human confirms consequential actions              | A live view to watch, and a recording to review afterwards            |

Anthropic also warns that in some circumstances the model "follows commands
found in content", such as a web page or an image, even when they conflict with
yours. This is the [prompt injection](/glossary/prompt-injection) risk. The
precautions above are there to contain it.

## Drive the desktop

```ts check
import { writeFile } from "node:fs/promises";
import { Sandbox } from "withruntime";

await using sbx = await Sandbox.create();
const { streamUrl } = await sbx.desktop.start({ width: 1280, height: 800 });
console.log("private live view:", streamUrl);
await sbx.desktop.open("https://example.com"); // waits for Chromium on first use
await sbx.network.set({ internet: true, allow: ["example.com"] }); // then narrow it
await writeFile("step-0.png", await sbx.desktop.screenshot()); // send to the model
await sbx.desktop.click(640, 400); // the model's chosen action
await sbx.desktop.type("hello");
```

```python check
from withruntime import Sandbox

with Sandbox.create() as sbx:
    sbx.desktop.start(width=1280, height=800)
    sbx.desktop.open("https://example.com")
    sbx.network.set(internet=True, allow=["example.com"])
    with open("step-0.png", "wb") as file:
        file.write(sbx.desktop.screenshot())
    sbx.desktop.click(640, 400)
    sbx.desktop.type("hello")
```

The desktop and Chromium are ready on every server. The first start in a sandbox
installs nothing and takes about a second. The sample narrows the network after
the first `open`. The same actions are available as MCP tools,
`runtime_sandboxes_desktop_act` and `runtime_sandboxes_desktop_screenshot`
([MCP](/docs/mcp)).

## Related

- [How to run a browser automation agent](/use-cases/browser-automation-agent)
- [What is a headless browser?](/glossary/headless-browser)
- [A desktop in the JavaScript SDK](/docs/javascript#a-desktop)
- [What is an agent sandbox?](/glossary/agent-sandbox)

## Sources

- [Anthropic, Computer use tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool), checked 25 October 2026

Facts on this page were checked on 25 October 2026.