Production computer-use agents need a controlled execution environment, access scoped to the user and task, and evidence that each operation succeeded. They also need recovery rules for interrupted work. Vercel Sandbox, AI SDK, and browser or desktop tools address different parts of that system.
Consider an agent that retrieves a monthly report from a supplier portal. Downloading the file may be enough for a demonstration. In production, the service must also establish who requested it, which account the browser used, whether the report covers the right period, and where the resulting file may be stored.
Copy link to headingWhat should run in each part of the system?
Separate the component deciding what to do from the environment performing the UI operation. This lets you restrict the browser's access and replace a failed worker without losing the task record. Keep authorization decisions outside the worker, and treat paths and metadata returned by untrusted execution as input to validate before retrieving or exposing an artifact.
AI Gateway provides model access and routing. It doesn't create a browser session. Similarly, a model's ability to interpret screenshots doesn't install a desktop or implement mouse input. The execution environment must supply those operations.
The AI SDK supports tool approvals, execution controls, and sandbox integration. Give each tool a defined input and result. An exportReport tool can offer narrower access than unrestricted shell commands.
Copy link to headingWhere should the browser or desktop run?
Run each user's task in an environment with an explicit owner and lifecycle. For browser work, that can be a dedicated browser process in isolated compute or a hosted browser service. Keep sessions belonging to different users separate, including saved authentication state and downloads.
Vercel Sandbox provides microVM isolation for execution. For a visual desktop example, the AI SDK Computer Use template installs the display, browser, and input utilities its agent needs. On Linux, agent-desktop still needs a graphical session and accessibility services supplied by the worker.
Decide which outbound destinations the worker needs. The report portal may depend on an identity provider and an asset domain as well as its main hostname. Test those dependencies before enforcing the allowlist.
agent-browser's browser-level security controls are optional and have documented compatibility limits. Combine them with network enforcement outside the browser when the worker must be restricted to approved destinations.
Copy link to headingHow can you bound the agent's tool access?
Expose the smallest operation that still lets the agent do useful work. For the report service, your application can validate the account and month before starting the browser. It can also restrict downloads to a task directory instead of letting the model choose an arbitrary output path.
This smaller example demonstrates bounded navigation and observation with AI SDK and agent-browser. The agent can inspect either of two public documentation pages. The application controls the URLs and command arguments, serializes browser operations, and closes the session afterward.
Use Node.js 24 or later on a macOS or Linux development worker. Install agent-browser and Chrome, then add these dependencies:
Set AI_GATEWAY_API_KEY in the server environment. Save the following as inspect-docs.ts and run it with npx tsx inspect-docs.ts. Running it makes a billed model request through AI Gateway.
The AI SDK stopping condition limits model steps. The separate counter permits browser work for at most four inspectDocs calls, even if the model requests more.
The queue keeps each page's navigation and snapshot together. Each subprocess has a 15-second timeout, and cleanup waits for the queued calls to settle. An active subprocess and cleanup can outlast the 60-second model deadline.
This is a development example of an application-level restriction. The browser can still load resources or follow redirects, so fixed tool arguments don't replace worker isolation or an egress policy. For ordinary public documentation retrieval, an HTTP fetch may be sufficient; the example uses a browser to show how to wrap navigation and UI observations in a bounded model tool.
Copy link to headingHow should authentication and approval work?
Keep the browser identity tied to the user who authorized the task. Sharing an administrator session can give every request access to the same privileged account. Record the session owner and allowed account before opening the portal.
Avoid putting passwords or multi-factor authentication codes in model messages. Use a hosted sign-in handoff with eve, Vercel Connect, and KERNEL managed auth. Connect brokers access to the browser provider; the hosted login signs the user into the target site.
Authentication and approval answer different questions. Signing in establishes access, while an approval authorizes a proposed operation. Permission to download October's report doesn't authorize changing the account's billing settings. For a consequential write, show the reviewer the exact account, target, and proposed values, and check that the live state still matches before execution.
Approvals must work at the level where the effect occurs. Permission to "click" cannot distinguish opening a menu from submitting a payment. Use application-specific tools or an orchestration check to evaluate the operation before dispatch.
Copy link to headingHow should the agent recover from a timeout?
When a browser tool times out, the outcome can remain unknown. The portal might have received an export request even if the tool didn't return its response. Clicking Export again could create a second job or another download.
Classify the next action using observed state:
Store enough information to reconcile the operation, including the task ID, requested reporting period, and any export identifier. Where an API supports idempotency keys, use them for API writes. Retrying a workflow step doesn't make its UI clicks idempotent.
Place retry boundaries around UI operations whose effects you can check. Workflows and Sandbox can record progress and resume tasks, but your application must still determine whether external actions succeeded.
Copy link to headingWhat state needs to survive between runs?
Keep the task's business progress separate from browser state. For the report example, useful progress includes the authorized account, requested month, export status, and verified file location. The next run should be able to inspect those facts before opening another browser.
The browser profile can preserve authentication, but the target site may expire or revoke the session. Saved element references can become invalid after a page reload. Revalidate the login and observe the UI again when resuming work.
Vercel Sandbox persistence saves filesystem state when a session stops and restores it on resume. It doesn't preserve a running browser's memory. Configure session duration separately from filesystem persistence.
When files need to outlive a particular sandbox or be available to later sandboxes, Vercel Drives provide separately managed storage. Set retention and access rules for downloaded reports as deliberately as you do for the original portal.
Copy link to headingHow do you measure whether the agent is ready?
Evaluate the task outcome against evidence outside the model's final answer. For a report export, check that the file exists, contains the expected account and period, and has the required columns. Also check for login pages saved as reports.
Include failures that resemble production conditions. Test expired sessions, slow exports, changed labels, empty reports, and duplicate submissions. Record task completion, stops with accurate explanations, and false success claims.
Track cost per verified completion alongside elapsed time and intervention rate. Repeated screenshots and failed actions can increase model usage even when the final response is short. Model costs are only one part of the total: browser infrastructure, allocated memory, and artifact storage also contribute. Stop unused compute when the task or handoff no longer needs it.
Retain enough trace information to diagnose a failure without logging the entire authenticated screen by default. For example, a timestamped action record and a redacted screenshot of the failed control may answer the debugging question without retaining unrelated customer data.
Copy link to headingFrequently asked questions
Copy link to headingDoes isolating a browser make its actions safe?
No. Isolation protects the surrounding execution environment, but a signed-in browser can still act with the permissions of its account. Scope that account and enforce which operations the task may perform.
Copy link to headingCan workflow retries guarantee that a form is submitted once?
No. Submissions can succeed before the worker loses its response. Check the application's resulting state before retrying a UI operation, or reuse the original idempotency key when retrying an API request.
Copy link to headingShould a computer-use agent receive the user's password?
Use a sign-in handoff or credential mechanism that keeps the password out of model messages. The resulting authenticated session still needs an owner, access restrictions, and a defined lifetime.
Copy link to headingDoes a saved sandbox preserve the browser's live session?
No. Sandbox persistence saves the filesystem, which can include browser files you explicitly maintain. On resume, restart the worker's processes, restore supported browser state, and check that the site's authentication remains valid.
Copy link to headingWhat is the right cost metric for a computer-use agent?
Measure total cost per verified task completion. Include model requests and execution costs, and track failed attempts and human intervention so a lower token bill doesn't hide a worse completion rate.