<div id="readability-page-1" class="page"><div><h4 id="table-of-contents">Table of contents</h4>
<ul>
<li><a href="#an-open-source-computer-use-agent">An open source computer use agent</a></li>
<li><a href="#technical-challenges">Technical Challenges</a>
<ul>
<li><a href="#challenge-1-security">Challenge 1: Security</a></li>
<li><a href="#challenge-2-clicking-on-things">Challenge 2: Clicking on things</a></li>
<li><a href="#challenge-3-reasoning">Challenge 3: Reasoning</a></li>
<li><a href="#digression-agent-frameworks-are-mostly-useless">Digression: Agent frameworks are mostly useless</a></li>
<li><a href="#challenge-4-deploying-niche-llms">Challenge 4: Deploying Niche LLMs</a></li>
<li><a href="#challenge-5-streaming-the-display">Challenge 5: Streaming the display</a></li>
</ul>
</li>
<li><a href="#thoughts-on-the-future">Thoughts on the future</a>
<ul>
<li><a href="#apis-and-accessibility-apis">APIs and Accessibility APIs</a></li>
<li><a href="#authentication-and-sensitive-information">Authentication and Sensitive Information</a></li>
</ul>
</li>
<li><a href="#conclusion">Conclusion</a></li>
</ul>
<h2 id="an-open-source-computer-use-agent">An open source computer use agent</h2>
<p>I made this! It’s an LLM-powered tool that can use all the functionalities of a personal computer.</p>
<figure></figure>
<p>It takes a command like “Search the internet for cute cat pictures” and uses LLM-based reasoning to operate the mouse and keyboard of the computer on autopilot.</p>
<p>How is this different than other tools that exist already? It’s <a href="https://github.com/e2b-dev/secure-computer-use/" target="_blank" rel="noopener noreferrer" data-external="true"><strong>fully open source</strong></a> and uses <strong>only open weight models</strong>. That means that anyone can run and modify my project in any way.</p>
<p>The computer use agent is a work in progress and has limited accuracy, but is showing noticeable improvement every few days. In this article, I’ll give you a tour of how it works. The short explanation is as follows:</p>
<p>The agent <strong>takes many screenshots and asks Meta’s Llama 3.3 LLM what to do next</strong> (click, type, etc.) until the response is that that the task is finished.</p>
<p>Technically, there are a few more components in the system. Here’s an in-depth flow chart of the program and <strong>all of the critical components</strong>:</p>
<figure></figure>
<p>This schematic, of course, is just a snapshot of what I have right now, which took me about a month to develop. The LLMs and tools in the diagram will rapidly change as I experiment.</p>
<h2 id="technical-challenges">Technical Challenges</h2>
<p>To solve this, I had some pretty daunting challenges.</p>
<ol>
<li><strong>Security</strong>: Isolating the operating system in a safe, controlled environment</li>
<li><strong>Clicking on things</strong>: Enabling the AI to click precisely to manipulate UI elements</li>
<li><strong>Reasoning</strong>: Enabling the AI to decide what to do next (or when to stop) based on what it sees</li>
<li><strong>Deploying niche LLMs</strong>: Hosting open source models, specifically OS-Atlas, in a cost-effective way</li>
<li><strong>Streaming the display</strong>: Finding a low latency way to show and record video of the sandbox</li>
</ol>
<h3 id="challenge-1-security">Challenge 1: Security</h3>
<p>The ideal environment to run an AI agent should be easy to use, performant, and secure. Giving an AI agent direct access to your personal computer and file system is dangerous! It could delete files, or perform other irreversible actions.</p>
<p>Rather than give the agent access to my computer, I used <a href="https://e2b.dev/" target="_blank" rel="noopener noreferrer" data-external="true"><strong>E2B</strong></a>. E2B is a cloud platform that provides secure sandboxes meant to augment AI agents. It’s most common use-case is to run Python code (to generate Perplexity’s charts, for example) but it now supports running a full-fledged Ubuntu system with GUI applications. Thus, it’s perfect for this project.</p>
<h3 id="challenge-2-clicking-on-things">Challenge 2: Clicking on things</h3>
<figure></figure>
<p>Now, we’re getting to the fun part. LLM-based “computer use” is fairly straightforward when the interface is text-based, and you can get far with just text-based commands.</p>
<p>However, there are some applications you will basically never be able to use without a mouse. Thus, for a comprehensive computer use agent, we need this feature.</p>
<p>I was also not satisfied with solutions that used traditional computer vision models as a “bridge” between the screen and LLM. They did great for recognizing text and some icons, but they had no idea what was a text field vs. a button or some other element.</p>
<p>Then, I came upon some promising research out of China on building “grounded VLMs.” This is a vision LLM with the ability to output precise coordinates referencing the input image. Both Gemini and Claude have this ability, but are neither are open source nor published. The OS-Atlas team, on the other hand, has published their weights on Hugging Face and outlined <a href="https://arxiv.org/pdf/2410.23218" target="_blank" rel="noopener noreferrer" data-external="true"><strong>the fascinating training process in this paper</strong></a>.</p>
<h3 id="challenge-3-reasoning">Challenge 3: Reasoning</h3>
<figure></figure>
<p>The power of LLM-based agents is that they can decide between multiple actions, and make educated decisions using the most recent information.</p>
<p>Over the past year, we’ve seen a gradual increase in LLMs’ abilities to make these decisions. The first approach was to simply prompt the LLM to output actions in a given text format, and to add the result of the action to the chat history before calling the LLM again. All following approaches have been roughly the same, with fine-tuning used to compliment the system prompts. This general ability was called <strong>function calling</strong>, while the term <strong>tool-use</strong> is now more popular.</p>
<p>The combination of vision to inform tool-use in a single LLM call is a fairly new thing that hasn’t seen much mileage yet. I tried a few different open source models to get this, and I’ll summarize the following part briefly since it will probably be outdated in a couple of weeks anyway. In my agent, I used:</p>
<ul>
<li><strong>Llama-3.2-90B-Vision-Instruct</strong> to view the sandbox display, and decide on next steps to take</li>
<li><strong>Llama 3.3-70B-Instruct</strong> to take the decision from Llama 3.2 and rephrase it in tool-use format</li>
<li><strong>OS-Atlas-Base-7B</strong> as a tool that can be called by the agent to perform a click action given a prompt of what to click</li>
</ul>
<h3 id="digression-agent-frameworks-are-mostly-useless">Digression: Agent frameworks are mostly useless</h3>
<p>If you’ve looked into building AI agents, you’ve probably asked the question: Why are there so many frameworks out there?</p>
<p>In my personal experience, the utility of these frameworks is to abstract 1) LLM input formatting and output parsing, 2) the agent prompts and 3) the agent run loop. Since I want to keep my run loop very simple, the main use in a framework would be to handle the interface with the LLM provider, especially for tool-use and images. However, most providers are now standardizing towards the OpenAI tool-use format <strong>anyways</strong>, and when there are exceptions it’s often not clear from the documentation if the framework handles them. And as for the system prompts, I really <strong>don’t</strong> want this to be abstracted, since this is one part of the code I need to adjust all the time.</p>
<p>If you’ve had a different experience than the above—That’s cool, I’d love to hear your thoughts!</p>
<p>Also, one big lesson that I have learned about tool use is that it’s not really a single feature. It’s a whole hodgepodge of LLM fine-tuning, various prompts, and string formatting and parsing on either the API side or on the client side. It is just so hard to make a framework (and keep it updated) to fit together all these parts without the developer needing to look inside.</p>
<h3 id="challenge-4-deploying-niche-llms">Challenge 4: Deploying Niche LLMs</h3>
<p>Since I want my agent to run fast, I wanted to run the LLM inference in the cloud. I also wanted it to work out-of-the-box for curious people like yourself.</p>
<p>Unfortunately, this was much easier said than done. There are numerous inference hosting providers, and they all have there different points of friction. Fortunately, Llama 3.2 and 3.3 are fairly common, and I found OpenRouter, Fireworks AI, and the official Llama API to be pretty good options. They all provide “serverless” hosting, which essentially means that you only pay marginal costs and no fixed costs.</p>
<p>But, there were no such options for OS-Atlas. I reached out to a number of inference providers, and what I eventually learned is that economies of scale make it prohibitive for hosts to put out serverless versions of infrequently used models. With few users, it’s hard for them to distribute the costs of the hosting and the engineering time amongst these users.</p>
<p>I ended up using a free Hugging Face Space to call OS-Atlas. This is relatively slow (takes a few seconds for each call) and is rate-limited (a few dozen calls per hour) but it gets the job done for now.</p>
<h3 id="challenge-5-streaming-the-display">Challenge 5: Streaming the display</h3>
<p>In order to see what the AI is doing, we want to get live updates from the Sandbox’s screen. I wondered if I do this using ffmpeg. After bashing random shell commands for a while, I found the right magic incantations:</p>
<p>Server: <code>ffmpeg -f x11grab -s 1024x768 -framerate 30 -i $DISPLAY -vcodec libx264 -preset ultrafast -tune zerolatency -f mpegts -listen 1 http://localhost:8080</code></p>
<p>Client: <code>ffmpeg -reconnect 1 -i http://servername:8080 -c:v libx264 -preset fast -crf 23 -c:a aac -b:a 128k -f mpegts -loglevel quiet - | tee output.ts | ffplay -autoexit -i -loglevel quiet -</code></p>
<p>The first command basically creates a video streaming server over HTTP which can stream to one client at a time. The second command captures the stream, and simultaneously writes it to a .ts file, and displays it in a GUI.</p>
<p>This works fine over the internet. The server is some kind of built in feature of FFmpeg, but has the limitation that it can only stream to one client at a time. Therefore, the client must use the tee command to split the stream so it can be both saved and displayed. (Please don’t ask me anything about codecs or any of the other flags up there!) In the future, the plan is to either reduce the latency of the stream or replace it entirely with a VNC connection.</p>
<h2 id="thoughts-on-the-future">Thoughts on the future</h2>
<p>This has mainly been an article of what I built with the tools available to me. A major goal of the project was that it is operating system agnostic, application agnostic, and to the extent possible, LLM agnostic. This worked, although</p>
<h3 id="apis-and-accessibility-apis">APIs and Accessibility APIs</h3>
<p>One recurring theme that came up in my work was the question of whether computer use agents in general should lean more heavily on APIs (coded pathways) or GUI only (pure vision). The answer is clearly: Agents <strong>should</strong> make use of APIs as much as possible, but most software is just not made to be controlled this way.</p>
<p>That’s why in my testing, I wanted to make sure the agent could open a web browser, click on the URL bar, type some text, etc., even though there is an equivalent shell command that can do the same thing. When designing a computer use agent, we should also consider the non-visual interfaces that are available to us, and here are a few:</p>
<ol>
<li><strong>Standard APIs</strong>: These include APIs such as the file system API, the Microsoft Office API, or the Gmail REST API, which provide structured access to useful functionalities.</li>
<li><strong>Code Execution</strong>: This involves running scripts or commands, such as executing Bash or Python code to launch an application or parse the contents of a file.</li>
<li><strong>Accessibility APIs</strong>: The OS or desktop environment often provides accessibility APIs that allow direct interaction with the GUI hierarchy. Unfortunately, support on Linux tends to be worse than macOS or Windows.</li>
<li><strong>Document Object Model (DOM</strong>): The DOM enables interaction with web pages in a semi-structured, text-based manner.</li>
<li><strong>Model Context Protocol (MCP</strong>): The Model Context Protocol is a is a newly introduced API specifically designed to both provide context and actions in an agent-friendly manner.</li>
</ol>
<p>Given the number of options, it’s somewhat of a tragedy that we have to rely on vision which is a far more burdensome task for an AI. This is especially true for #3, since better accessibility APIs would be beneficial for many (vision impaired) humans as well. It would be amazing if everything could work like Zapier, where everything is connected with the right adapters. We can only hope!</p>
<h3 id="authentication-and-sensitive-information">Authentication and Sensitive Information</h3>
<p>Another huge open question is how to securely handle authentication. The <strong>insecure approach</strong> would be to provide the agent with the same level of access as the user. A <strong>secure approach would be to scope permissions</strong>, as is commonly used by OAuth apps, iOS apps, etc. such as the example below:</p>
<figure></figure>
<p>In our agent we’ve avoided this problem entirely by creating a fresh, isolated sandbox with no user data or credentials. But this also doesn’t solve the problem.. If a secure approach isn’t available to users, they tend to create an insecure one. Therefore, it’s important to already start thinking about the following:</p>
<ul>
<li>Ways to provide computer use agents with <strong>scoped access to APIs</strong>: For example, a computer use agent uses a traditional API to view the user’s email inbox without the ability to delete or send emails</li>
<li>Ways to <strong>redact sensitive information</strong> passed to the LLM, and restore it in the LLM output: For example, a user can set secrets, such as CREDIT_CARD_NUMBER, which can be passed to tools but not seen by the LLM</li>
</ul>
<h2 id="conclusion">Conclusion</h2>
<p>The AI computer use agent I made is a prototype that can use the computer about as well as I could when I was five or six. It still has a lot of trouble planning next steps and often doesn’t know where to focus its attention on the screen. For example, it may not notice if a text field is selected or not, or it may lose sight of the original goal when presented with a full screen of text. This is not at all surprising for an LLM.</p>
<p>That said, reasoning with vision is an area where we expect to see a lot of improvement in open source models on a monthly basis, and even while I’ve been writing this article, new models have been released that I’m excited to try out. Meanwhile, I’m also excited to augment the agent’s abilities by adding additional APIs to the agent’s toolbox.</p>
<p>If this is a problem that’s interesting to you, check out <a href="https://github.com/e2b-dev/secure-computer-use/" target="_blank" rel="noopener noreferrer" data-external="true"><strong>the source code</strong></a> and <a href="https://www.linkedin.com/in/jamesmurdza/" target="_blank" rel="noopener noreferrer" data-external="true"><strong>reach out to me</strong></a>.</p></div></div>

E2B Blog & Customer Stories

Vaclav Mlejnsky

How to overcome challenges like security, clicking on things, reasoning, or streaming the display

How I taught an AI to use a computer

댓글