aiqbench analysis
The paper targets a real weakness in computer use agents: they act on screen pixels, so they can't tell a trusted interface element from one an attacker has planted. SA-CUA proposes a dual-LLM design that derives trust regions from the accessibility tree and gates untrusted values through a verification channel, aiming to cut confirmation prompts while keeping attack success at zero on the authors' evaluation. Readers should weigh the reported zero attack rate against the benchmark's scope, since that result depends on the threat model and the rule set's conservatism.
Towards Safe Autonomy for Computer Use
arXiv:2610.18508v1 Announce Type: cross Abstract: The safety of LLM-based agents currently rests on alignment training and safety classifiers, neither of which can rule out that a sophisticated indirect prompt injection (IPI) goes through and causes significant harm. Recent work therefore builds agents with information-flow guarantees that rely on structured tool interfaces to interact with the environment. Computer Use Agents (CUAs) act visually on the computer screen, which does not provide a boundary between trusted first-party interfaces and untrusted, potentially attacker-authored content. Actions are equally ambiguous: a click may land on an application toolbar or a button controlled by an attacker. Treating the user as the source of trust and confirming each sensitive decision produces confirmation fatigue, with the risk of missing harmful actions. We introduce SA-CUA, a dual-LLM framework that generates a reliable trust boundary for CUAs by deriving conservative deterministic rules from the accessibility tree for unmasking trusted regions from the privileged LLM's screenshot, keeping trusted and untrusted content separated. Human interaction is only required for proper task specification in the beginning. During the task a robust endorsement channel allows values to pass from the untrusted to the trusted domain by verifying information via trusted channels. This allows the agent to autonomously handle tasks involving untrusted information. SA-CUA maintains much higher utility than CaMeL-CUA while keeping the attack success rate at zero.
Abstract:The safety of LLM-based agents currently rests on alignment training and safety classifiers, neither of which can rule out that a sophisticated indirect prompt injection (IPI) goes through and causes significant harm. Recent work therefore builds agents with information-flow guarantees that rely on structured tool interfaces to interact with the environment. Computer Use Agents (CUAs) act visually on the computer screen, which does not provide a boundary between trusted first-party interfaces and untrusted, potentially attacker-authored content. Actions are equally ambiguous: a click may land on an application toolbar or a button controlled by an attacker. Treating the user as the source of trust and confirming each sensitive decision produces confirmation fatigue, with the risk of missing harmful actions. We introduce SA-CUA, a dual-LLM framework that generates a reliable trust boundary for CUAs by deriving conservative deterministic rules from the accessibility tree for unmasking trusted regions from the privileged LLM's screenshot, keeping trusted and untrusted content separated. Human interaction is only required for proper task specification in the beginning. During the task a robust endorsement channel allows values to pass from the untrusted to the trusted domain by verifying information via trusted channels. This allows the agent to autonomously handle tasks involving untrusted information. SA-CUA maintains much higher utility than CaMeL-CUA while keeping the attack success rate at zero.
Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2610.18508 [cs.CR]
(or arXiv:2610.18508v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2610.18508 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 316 words
Related coverage
Rivian’s Gambit for Full Autonomy
IEEE Spectrum · Sep 8, 2026
I Did This Without Your Knowledge
LessWrong · Oct 17, 2026
RL & search is a terrifying way to build AGI (an FAQ)
AI Alignment Forum · Jul 27, 2026
Smart Car Researcher Wants to Eliminate Stoplights
IEEE Spectrum · Oct 2, 2026