Enterprise IT / Security
Computer-use agents on internal apps
A computer-use agent drives a browser — clicking, typing, and filling forms across web apps, including your internal admin panels and partner portals.
Real example — shipping today
source →OpenAI · ChatGPT agent (Operator)
A computer-using agent that drives its own virtual browser — clicking, typing, and filling forms to book, order, and operate connected apps and email across live sites.
Their own controls — OpenAI has it pause for confirmation before consequential actions and hand control back to the user for logins.
The danger without a gate
The agent’s blast radius is every site it can reach. On internal apps it can submit any form its session can see, and a hostile page can inject instructions that redirect it mid-task — with the only record being the vendor’s own UI history.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
The internal app fronts its writes with MCPIP
Instead of trusting the raw browser session, the app routes its write API through the gate. A legitimate form submission authorizes on its real arguments and executes.
$ mcpip --json authorize skill_update_vendor_record \
--arg vendor=vendor_3kP1 --arg field=payout_schedule --arg value=weekly{
"decision": "allow",
"status": "executed",
"transaction_ref": "txn_e10a44",
"executed_target_class": "rest",
"worm_sequence": 48222,
"correlation_id": "77b1c0de"
}attackThe attack: a hostile page redirects the task mid-session
An injected instruction tries to change a bank account instead of a schedule. That field isn’t in the alias’s argument grant, so it’s denied — and the attempt is still recorded.
$ mcpip --json authorize skill_update_vendor_record \
--arg vendor=vendor_3kP1 --arg field=bank_account --arg value=attacker{
"error": "denied",
"correlation_id": "d3f902e1"
}The result
A computer-use agent whose reach into your systems is scoped, step-up gated, and independently audited.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →