Anthropic's Claude Computer use — agentic threat model

Utilizes Claude's foundation models with extended thinking capabilities. Highly vulnerable to indirect prompt injection if the agent processes untrusted files, pull requests, or external documentation containing malicious instructions designed to hijack the model's reasoning.

Operates directly on local codebases, reading files, git history, and terminal outputs. Risks include data exfiltration of proprietary source code if the agent is manipulated into sending codebase contents to external endpoints, or codebase poisoning where malicious local files manipulate the agent's behavior.

Orchestrates multi-step terminal commands, file editing, and test execution. The primary threat is tool misuse, where prompt injection or planning errors lead the agent to execute destructive shell commands (e.g., deleting files, modifying system configurations, or installing malicious dependencies).

Not certain from the listing — the exact sandboxing mechanisms for local terminal execution are not detailed. If run directly on the host system without containerization, a compromise of the agent leads directly to host compromise, privilege escalation, and lateral movement using the developer's local SSH keys and cloud credentials.

Provides observability through a 'scratchpad' and 'extended thinking mode' that reveals its reasoning process. However, security blind spots remain if there is no independent, tamper-proof logging of the actual shell commands executed by the agent versus what it reports in the scratchpad.

Not certain from the listing — specific enterprise compliance controls, command whitelisting, or human-in-the-loop approval configurations are not detailed. Without strict policy enforcement, the agent may violate compliance by committing unreviewed code or accessing unauthorized environments.

Not certain from the listing — there is no explicit mention of multi-agent orchestration or marketplace integrations. The primary ecosystem risk is limited to cascading failures if the agent interacts with local CI/CD pipelines or automated git hooks.