Securing Computer-Use Agents Against Branch Steering Attacks
Branch steering attacks achieve 94.4% success against computer-use agents and 89.5% against Dual-LLM; COBRA architecture cuts success to 0% while keeping 97% utility.
Researchers introduce branch steering attacks, where adversaries craft untrusted web content to coerce computer-use agents down hazardous pre-approved execution branches without explicit injected instructions. The attacks bypass the Dual-LLM pattern's formal guarantees because plans in graphical environments must branch on runtime data. Using STEER-Bench (101 tasks across 9 domains), attacks succeed against 94.4% of standard CUAs and 89.5% of vanilla Dual-LLM CUAs. The proposed COBRA architecture pairs trusted branching plans with ahead-of-time capability constraints, reducing attack success to 0% while retaining 97% benign utility.
- Branch steering succeeds against 94.4% of standard CUAs and 89.5% of vanilla Dual-LLM CUAs
- Attacks coerce agents down pre-approved branches without explicit instruction injection
- STEER-Bench spans 101 tasks across 9 domains
- COBRA bounds branch parameters and destinations, achieving 0% attack success at 97% utility
- Tags
- prompt-injectioncomputer-use-agentagent-securitydual-llmbenchmarkattack-surfacedefense-architecture
- Organizations
- COBRASTEER-Bench
From the original article
1 min read at arxiv.orgModern Computer Use Agents (CUAs) directly interact with graphical user interfaces and execute third-party web tools, exposing them to indirect prompt injection across every rendered page and tool response.
By Giulio Zingrillo · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.