Start with what a computer-use agent does inside an application that has no API. It reads what is rendered, then drives an approved interface to update records, navigate development tools, test software, and assemble results into reports [5]. Every one of those steps takes input from a screen the agent does not control. The post says so directly: content displayed in an application may be incomplete, misleading, or designed to influence an agent's behaviour [6]. That sentence describes prompt injection delivered through a user interface.
The remedy is worth reading closely for who holds the wrench. Foundry, per Microsoft, helps customers define access, approvals and monitoring, and design workflows with scoped credentials, approved resources, human checkpoints for consequential actions, and activity records aligned to their risk requirements [7]. Those are per-workflow artifacts somebody on the customer side authors. The platform half of the list is a different kind of thing: Entra identity, role-based access control, private networking, encryption in transit and at rest, content filtering, safety evaluations, monitoring, governance tools [4]. These are knobs, and a knob does not decide which action stops for a human.
Microsoft's list of where AI initiatives slow down names six items [3]. String-match it against the capability list: four of the six have a control named after them, and data handling and compliance are the exceptions [15]. Data handling does get one specific commitment elsewhere in the post: prompts and outputs are not used to train the models [10].
The model-level claim is thinner than the platform one. OpenAI reports state-of-the-art results on selected computer-use evaluations, and the same paragraph notes that performance varies by task, tools, configuration and safeguards [8]. No benchmark is named and no score is given, and OpenAI plans to publish its alignment, safety and computer-use evaluations in supporting launch materials [9]. For a computer-use number to transfer to your estate you would need the same application set, the same tool wiring, and the same safeguard configuration. The safeguards you are told to add include human checkpoints on consequential actions [7], which is the one thing an unattended evaluation harness is unlikely to have.
Set the two supplied versions of this page side by side and the only sentence that moves is the availability sentence [14]. The six blockers, the computer-use description, the containment paragraph and the Replit quote are the same text in both [14]. What changed is eligibility. The instructions for containing the thing are word for word what they were.
That is also where the honesty is. The post states that these capabilities help customers configure safeguards and maintain oversight, though risk elimination is outside their scope [11]. Take that at face value and general availability does not reduce the adoption cost by much: somebody still has to enumerate which resources the agent may reach, which credential it carries into each one, and which actions halt for review. Replit's CTO Luis Hector Chavez says Astra through Foundry unlocks agentic capability beyond code generation, into active software creation [12], and the gap between that sentence and a production deployment is the approval map, which the customer has to write.
