Skip to main content
Outcome: a working screenshot -> vision model -> desktop action loop, watchable live in a browser. Level: intermediate · Time: ~15 minutes · Pattern: the agent lives in the box.

When to use this

Some systems have no API — only an interface. Placing an order in a legacy ERP web app, clicking through a desktop configuration, exporting a report from a SaaS product with no SDK. Selector-based automation is brittle here, and sometimes simply impossible. Computer use takes the other road: a multimodal model looks at the screen and acts like a person. That is powerful and inherently dangerous — you have handed a program that decides its own clicks a machine with a filesystem and a network connection. One wrong click can really delete a file or really submit an order. ComputerBox bounds that risk. It boots an XFCE desktop with a browser inside a microVM and exposes mouse, keyboard, and screenshots as async methods. The agent works on a disposable machine that is fully isolated from your host, and you can watch it in a browser the whole time. Fits: automating GUI-only systems, evaluation sandboxes for computer-use agents, and high-risk desktop work that needs a human watching.

Architecture

Two channels reach the same desktop: your program drives it through ComputerBox methods, and a person watches through the forwarded HTTP port. The loop itself is observe -> think -> act, repeated.

Prerequisites

  • BoxLite installed and a working virtualization host — see Installation.
  • A vision-capable model on an Anthropic-compatible endpoint.
  • The first run pulls the desktop image, which is large. Allow several minutes and use a generous wait_until_ready timeout.

Build it

One full turn of the loop: take a screenshot, let the model read it and choose the next action, execute that action on the real desktop, then confirm.
The full method list and the screenshot() return shape are on Computer use (desktop).

Run it

The model looked at a real desktop and its decision moved a real cursor. Open http://localhost:3000 while the script runs to watch it happen.

Trust and limits

  • What the boundary covers. The entire desktop — window manager, browser, filesystem — runs in a microVM. An agent that deletes files, installs software, or fills in a form affects only that machine, and it is destroyed when the block exits.
  • Coordinates are the agent’s whole world. It acts on pixel positions from a 1024x768 screenshot. If a dialog moves or a font renders differently, a click lands somewhere unintended. Verify after acting — read cursor_position() or take another screenshot — rather than assuming the action did what the model meant.
  • Network is open by default. A browser on that desktop reaches the internet. For untrusted goals, narrow egress: Run untrusted tools safely.
  • The desktop is heavy. ComputerBox defaults to 2 vCPU and 2048 MiB and pulls a large image on first use. It is not a per-request primitive; keep one alive for a session rather than starting one per action.
  • wait_until_ready can time out. It raises TimeoutError — a catchable failure, not a crash. Raise the timeout on first pull.

Troubleshooting

Next steps

  • Loop it. Wrap observe-think-act in a while loop with a step budget and a stop condition, re-screenshotting after each action.
  • Keep a human in the loop. For high-risk goals, require confirmation before actions such as left_click on a submit button.
  • Prefer the browser when a page will do. Driving a page directly is far more reliable than pixel-clicking — see Scrape and analyze the web.
  • Watch a coding agent instead. Run Claude Code puts an autonomous coding agent in a box with the same desktop channel.