1. A method performed by data processing apparatus, the method comprising: executing a data object in a sandboxed environment wherein requests for sensitive actions are examined by the sandboxed environment before they are provided to a computing device; identifying an execution of a data object by the computing device; in response to identifying the execution of the data object, determining that the data object has requested a sensitive action of the computing device without already interacting with a user of the computing device, the determining including: monitoring, by an application monitor of the computing device as the data object is being executed, instructions requested by the data object during the execution; identifying, by the application monitor, the monitored instructions that are executed by the data object and that are requesting the sensitive action; determining, by the application monitor, that no previously monitored instructions that were previously executed have requested an interaction with a user; in response to determining that the data object has requested the sensitive action, classifying the data object as a high-risk data object; and in response to classifying the data object as a high-risk data object, performing a corrective action by a computing device on the data object.