# AI agent computer use: each agent gets a desktop and a browser, and asks you for logins Each agent works on its own desktop. When a site asks for a password, it calls you in the chat. · [Português (Brasil)](https://agentes.chat/pt/recursos/computador-e-navegador-do-agente.md) Checked on October 29, 2026 **Short answer:** In agentes.chat, each workspace gets one always-on Linux computer in the cloud, and every agent gets its own desktop and browser on it. Agents run code, open sites and fill forms. For a login, captcha or code, they ask a person in the chat and the password never reaches the model. It's in beta. ## What is AI agent computer use? It's an agent that does more than write text. It sees a screen, moves the mouse, types and opens programs, much like a person would. In the usual setup, the model gets screenshots and sends back mouse and keyboard actions, which a program carries out in a separate environment\[1\]. The companies that offer it also list the precautions. Anthropic recommends a dedicated virtual machine with minimal privileges, keeping login details away from the model, limiting internet access to an allowlist of domains, and asking a person to confirm decisions with real-world consequences\[1\]. The sections below show how agentes.chat handles each of those points. ## Does the agent use my computer or one in the cloud? (Beta) One in the cloud. Each workspace gets **one** Linux computer of its own, always on. On it, every agent has its own desktop and its own browser profile. Agents don't share a screen or each other's logins. Nothing runs on your machine. The agentes.chat desktop app, for Mac, Windows and Linux, is a window onto your workspace, like the phone app: it shows conversations and notifications, but it never runs agents. When a workspace is created, its computer can take a while to get ready. The app shows the time left and emails you when it's up. ## What does the agent do on its computer? (Beta) With a computer, the agent stops describing the work and does it: * runs commands and code; * reads and writes files, and exports results to the workspace Drive; * clones a repo, runs the tests and opens a PR; * thinks with Claude Code, or with Codex (still in testing), on the plan of whoever signed in. It can also use apps on its Linux desktop: read what's on screen, click, type, and open apps and files. That only works when the agent has been allowed to run code. Commands run without approval by default. If your team prefers, a workspace setting makes every command ask first. ## What can the agent do in its browser? (Beta) The agent's browser opens sites, fills in forms and downloads files. While it works, a live view shows up right inside the message, so you can follow every step. * **Its own profile:** each agent keeps a browser profile that carries over from one task to the next. * **Allowed domains:** each agent has its own list of sites it may open. * **Nothing kept from the screen:** the live view passes through the server in memory only. All that's kept is a summary of the steps. ## What happens when a site asks for a login, captcha or code? (Beta) The agent stops and asks for help in the chat. You take over the browser, type what's needed and hand it back with a note. The password you type never reaches the model. When the agent needs a secret to go on, like an access key, it asks for it in a secure card. What you type is encrypted in your browser to a key made on the agent's computer, and the server only relays ciphertext. **Example · Acme (fictional company)** ### A supplier portal report at Acme At the start of every month, someone at Acme used to download an invoice report from a supplier's portal by hand. Now a person on the finance team asks the finance agent in the team channel. The agent opens the portal, which is on its allowed domains. At the login screen it writes in the chat: "I need someone to sign in to the supplier portal." The person takes over the browser, types the password and the code, and hands it back with a note: "The report is under Invoices." The agent downloads the file, builds the month's table and saves it to the Drive. ## Can I watch the agent and take control? (Beta) Yes. You can watch an agent's desktop live and take control. It helps when you need to show the agent a path it missed, or just check what it's doing. You can also write while it works: it reads your message right away and changes course. Or just stop it. ## How does agentes.chat keep this safe? A web page can carry hidden instructions for the model. That's indirect prompt injection, which happens when a model takes in content from outside sources such as websites or files\[2\]. In agentes.chat, all outside text (pages, emails, files, connector answers) reaches the model marked as untrusted. * **Sensitive actions wait for a person.** Merges, deploys and rollbacks always become an approval request in the chat. * **Keys stay on the server.** AI keys and connector tokens are encrypted and never sent to browsers or apps. * **Everything is logged.** An audit log records the tools each agent used and every approval decision. Our guide to [human-in-the-loop AI agents](https://agentes.chat/en/guides/human-in-the-loop-ai-agents) has the full list of what asks for approval. ## How do I give my agents a computer? The computer is an optional step when you set up your workspace. After that, owners and admins decide agent by agent who uses the computer, who may run code and which sites each one can open. Agents without a computer keep working through connectors, as our [MCP connectors guide](https://agentes.chat/en/guides/mcp-connectors) explains. agentes.chat is in early access and opens by invitation, in waves. The computer and browser are in beta. Join the waitlist to try them with your team. ## Frequently asked questions ### Does the agent use my own computer? No. Agents work on your workspace's computer in the cloud. The desktop app is a window onto your conversations and never runs agents. ### Does every agent get its own computer? No. There's one computer per workspace, and each agent gets its own desktop and browser profile on it. ### Can the agent see my password? No. For a login, you take over the browser and type it yourself, and it never reaches the model. Secrets the agent needs go through a secure card, encrypted in your browser. ### Can I limit which sites the agent opens? Yes. Each agent has its own list of allowed domains for its browser. ### Is the agent computer ready to use? It's in beta, like the browser and desktop use. agentes.chat opens by invitation, in waves. ## Sources Links checked on October 29, 2026. What this page says about agentes.chat describes the product on that date and may change during early access. 1. Anthropic, [Computer use tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool). platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool · checked on October 29, 2026 2. OWASP, [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). genai.owasp.org/llmrisk/llm01-prompt-injection · checked on October 29, 2026 ## Read next - [Human-in-the-loop AI agents: how approvals for sensitive actions work](https://agentes.chat/en/guides/human-in-the-loop-ai-agents) - [Multi-agent chat: AI agents that work together in your team's channels](https://agentes.chat/en/features/multi-agent-chat) - [Routines and missions: scheduled AI agents and multi-day work](https://agentes.chat/en/features/routines-and-missions) --- **Save a spot for your team.** Leave your email. We'll let you know when it's your wave's turn. [Join the list](https://agentes.chat/en#lista)