1. A method performed by data processing apparatus, the method comprising: identifying an execution of a data object by a computing device; in response to identifying the execution of the data object, determining that the data object has requested a sensitive action of the computing device without already interacting with a user of the computing device, the determining including: monitoring, as the data object is being executed, instructions requested by the data object during the execution; identifying the monitored instructions that are executed by the data object and that are requesting the sensitive action; determining that no previously monitored instructions that were previously executed have requested an interaction with a user; and in response to determining that the data object has requested the sensitive action, classifying the data object as a high-risk data object.