Runtime gives a computer-use agent a Linux desktop inside its own microVM, driven from the SDK, with a private live view and MP4 recording. Anthropic's documentation tells developers to run computer use in "a dedicated virtual machine or container". It also says to limit internet access to an allow list. A Runtime sandbox is both, and its rules are enforced outside the machine (security).
How it works
In Anthropic's API, computer use is a client toolset. The model returns tool
calls such as screenshot, left_click or type. Your application performs
each one on a real screen and returns the result: a screenshot as an image, or
a short acknowledgment. The model then decides the next action. Anthropic lists
it as generally available on the Claude API and Google Cloud, with the
computer_toolset_20260801 version. The loop is the ordinary
agent loop, with pixels as the feedback.
Anthropic's precautions, and Runtime's answer
| Anthropic's recommendation | On Runtime |
|---|---|
| A dedicated VM or container, minimal privileges | A Firecracker microVM per sandbox; root there controls only the guest |
| Keep sensitive data, such as logins, from the model | Secrets the sandbox never holds; the proxy adds them for named hosts |
| Limit internet access to an allow list of domains | Per-sandbox allow lists, or internet off, applied immediately |
| A human confirms consequential actions | A live view to watch, and a recording to review afterwards |
Anthropic also warns that in some circumstances the model "follows commands found in content", such as a web page or an image, even when they conflict with yours. This is the prompt injection risk. The precautions above are there to contain it.
Drive the desktop
TypeScriptimport { writeFile } from "node:fs/promises";import { Sandbox } from "withruntime";await using sbx = await Sandbox.create();const { streamUrl } = await sbx.desktop.start({ width: 1280, height: 800 });console.log("private live view:", streamUrl);await sbx.desktop.open("https://example.com"); // waits for Chromium on first useawait sbx.network.set({ internet: true, allow: ["example.com"] }); // then narrow itawait writeFile("step-0.png", await sbx.desktop.screenshot()); // send to the modelawait sbx.desktop.click(640, 400); // the model's chosen actionawait sbx.desktop.type("hello");Pythonfrom withruntime import Sandboxwith Sandbox.create() as sbx: sbx.desktop.start(width=1280, height=800) sbx.desktop.open("https://example.com") sbx.network.set(internet=True, allow=["example.com"]) with open("step-0.png", "wb") as file: file.write(sbx.desktop.screenshot()) sbx.desktop.click(640, 400) sbx.desktop.type("hello")The desktop and Chromium are ready on every server. The first start in a sandbox
installs nothing and takes about a second. The sample narrows the network after
the first open. The same actions are available as MCP tools,
runtime_sandboxes_desktop_act and runtime_sandboxes_desktop_screenshot
(MCP).
Related
- How to run a browser automation agent
- What is a headless browser?
- A desktop in the JavaScript SDK
- What is an agent sandbox?
Sources
- Anthropic, Computer use tool, checked 25 October 2026
Facts on this page were checked on 25 October 2026.