computer-use-agents-operating-real-os-indirect-injection-success-rates-measured CLM-0035For computer-use agents operating on a real OS, indirect-injection success rates measured with a fixed hand-written injection template understate vulnerability, because an attacker that adapts phrasing from the agent's own refusal trajectories can reach substantial success on models the fixed template never penetrates.
Capability: Following instructions hidden in data
Observed on
Black-box attacker controlling a forum comment the agent reads; 50 web-to-OS tasks from RedTeamCUA; three frontier CUAs (Claude Opus 4.6/4.8, Gemini 3.5 Flash); success requires bo.
Sources
- Measured on 50 sampled tasks per model, three models. Baseline is RedTeamCUA's single urgency-laden template: 16%/4%/0% versus 54%/24%/28% for the adaptive pipeline. An ablation separates compositional search from the feedback loop, and two principles discovered on Opus 4.6 raised success on the two unseen models. Small task sample; attacker and analyzer are one model (Grok-4.3), so results are not shown to be attacker-independent.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- For tool-using agents, enforcing injection defense as a deterministic provenance check on sensitive tool parameters — with the only model call reading the trusted user request and never fetched content — makes admission decisions invariant to how an injection is worded, whereas defenses that judge the agent's runtime plan or behavior with a model can be steered by reworded injections.Following instructions hidden in data · reviewed by AI
- For tool-using agents trained against adaptive indirect prompt injection, attack success measured against a single frozen adaptive attacker understates vulnerability compared with taking the per-case success union over a population of retained attacker checkpoints (0.25% vs 4.97% on the same 1,187 adaptive cases for the trained defender).Following instructions hidden in data · reviewed by AI
- Prompt injection defenses that report near-zero attack success on short-context benchmarks lose most of that protection when the injected instruction sits inside a document of thousands to tens of thousands of tokens: fine-tuned separation defenses and detect-localize-remove pipelines still let a large share of injections through on paper review, resume screening, code review and email threads.Following instructions hidden in data · reviewed by AI
- For image-borne injected instructions delivered to tool-using agents, completion rate understates exposure: agents act on the injected instruction about ten times more often than they complete the objective (12.8% attempted vs ~1% completed across 720 runs), and most failures stop at the planning step where the model read the payload and simply did not act on it rather than at any architectural barrier.Following instructions hidden in data · reviewed by AI
- For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.Following instructions hidden in data · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: An adaptive, feedback-driven injection search that fails to beat the fixed template on models where the template scores near zero, or whose gains vanish under the same deterministic joint-success oracle. Proposed technique, not catalogued: Failure-driven attack principle discovery.