Control Flow Integrity for Computer Use Agents

When AI agents control your mouse, a single malicious email can drain your accounts. We built the first system-level defense to sandbox these agents, and the results challenged our assumptions about AI.

It turns out, digital environments are more predictable than we admit -- half of OSWorld tasks can be solved without the agent ever seeing the screen. By leveraging this, CaMeLs provides strict security without killing performance. You don't need an omnipotent agent; you need a predictable one.