Library

Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming

Recent computer-using-agent (CUA) red-teaming papers report prompt-injection attack success rates (ASR) of 42-98%, but these headline numbers cluster on retired models and on the most-vulnerable model in each paper's panel. We ask whether those techniques, reproduced as hand-crafted templates, still work against current frontier CUAs. We release CUA-HandCrafted, a public benchmark of 793 episodes spanning 24 multi-step web tasks, 56 attack templates, 8 attack families, and 4 system-prompt configurations. Against Claude Sonnet 4.6 and GPT-5.4 we measure 0/140 multi-step attack success (Clopper-Pearson 95% upper bound 2.60%); a prompt ablation shows this resistance lives in the model weights. Yet it does not generalize: on a sister coding-agent benchmark (SkillBench), the same weights fall to hand-crafted skill-injection at up to 100%. We argue that the literature's high ASR is largely attributable to RL-optimized injection text rather than the attack categories, and that frontier safety hardening is domain-conditioned, specific to the heavily-targeted browser surface. Reporting techniques without releasing the optimized strings, or extrapolating browser-domain safety to other CUA modalities, makes published ASR numbers unreproducible.

Language & NLPSecurity & robustnesscs.CRcs.AIcs.CLComputer ScienceEngineering
Source

Paper

Similar papers

RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS EnvironmentsZeyi Liao, Jaylen Jones, Linxi Jiang et al.2025 · arXiv (Cornell University) In Library
Code Agent can be an End-to-end System Hacker: Benchmarking Real-world Threats of Computer-use AgentWeidi Luo, Qiming Zhang, Tianyu Lu et al.2025 · arXiv.org · 6 citations In Library
The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use AgentsXuwei Ding, S. Zhai, Linxin Song et al.2026 · 3 citations In Library
Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security AssessmentYuchong Xie, Mingyu Luo, Zesen Liu et al.2025 · 2 citations In Library
How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public CompetitionMateusz Dziemian, Maxwell Lin, Xiaohan Fu et al.2026 · 4 citations In Library
Computer Use at the Edge of the Statistical PrecipiceP. D'Oro, S. Silwal, William R. Wong et al.2026 · 0 citations In Library
Agents reading web pages, emails and repository files are hijacked by prompt injections hidden in untrusted content, yet 2026 benchmarks show deployed guards over-block benign text, making them unusable inline. A naive single prompt asking a base model whether text is an injection fails because without the agent's declared task it cannot separate legitimate imperative content, such as a README's install instructions, from instructions subverting the agent, returning a bare score with no offending span or operating point. Evaluate a task-conditioned LLM judge seeing the declared task and permitted capabilities alongside the untrusted output, using constrained structured decoding to emit is_injection, targeted_capability, quoted span and confidence, retrieving injection patterns for few-shot grounding, and applying a threshold calibrated on a benign corpus with self-consistency voting. Measure ROC-AUC, recall at sub-one-percent false-positive rate, span-localization precision and Brier calibration on AgentDojo-style labeled attack traces plus held-out benign corpora, beating a naive single-prompt base-model classifier and a Llama-Guard-style guardrail. Deliver as the prototype a minimal runnable Python MCP server (stdio) exposing the priced AI tool screen_tool_output that invokes a language or ML model to produce its output, with a typed input/output schema, an x402-style pay-per-call metering stub that records a per-call price in USDT and emits a settlement receipt, and one smoke test that exercises the tool end to end.Dogukan Ali Gundogan2026 · Zenodo (CERN European Organization for Nuclear Research) In Library
Agents reading web pages, emails and repository files are hijacked by prompt injections hidden in untrusted content, yet 2026 benchmarks show deployed guards over-block benign text, making them unusable inline. A naive single prompt asking a base model whether text is an injection fails because without the agent's declared task it cannot separate legitimate imperative content, such as a README's install instructions, from instructions subverting the agent, returning a bare score with no offending span or operating point. Evaluate a task-conditioned LLM judge seeing the declared task and permitted capabilities alongside the untrusted output, using constrained structured decoding to emit is_injection, targeted_capability, quoted span and confidence, retrieving injection patterns for few-shot grounding, and applying a threshold calibrated on a benign corpus with self-consistency voting. Measure ROC-AUC, recall at sub-one-percent false-positive rate, span-localization precision and Brier calibration on AgentDojo-style labeled attack traces plus held-out benign corpora, beating a naive single-prompt base-model classifier and a Llama-Guard-style guardrail. Deliver as the prototype a minimal runnable Python MCP server (stdio) exposing the priced AI tool screen_tool_output that invokes a language or ML model to produce its output, with a typed input/output schema, an x402-style pay-per-call metering stub that records a per-call price in USDT and emits a settlement receipt, and one smoke test that exercises the tool end to end.Dogukan Ali Gundogan2026 · Zenodo (CERN European Organization for Nuclear Research) In Library
Measuring Harmfulness of Computer-Using AgentsAaron Xuxiang Tian, Ruofan Zhang, Janet Tang et al.2025 · arXiv.org · 6 citations In Library
MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent SkillsWenbo Guo, Wei Zeng, Chengwei Liu et al.2026 · 5 citations In Library
© 2026 NYSGPT2525 LLC