the answer isn't sandbox everything, it's knowing which steps need AI judgment and which should be deterministic code. I lean towards the latter as much as possible
Nice demo. The prompt injection concern is real for any browser agent in production. We've found that the hybrid approach (deterministic steps + AI for the unpredictable parts) combined with step-level observability is what gives teams confidence to run these unattended. The 'fixed action set' is a good start.