arxiv-2608-30207 · paper

SIR: Self-improving Red-teaming for Compute Use Agents

Created: 2026-08-31 · Ingested: 2026-09-09

Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal, and they are increasingly deployed to automate everyday digital tasks. Because they can be exposed to untrusted content while operating, they are vulnerable to indirect prompt injection (IPI), in which an adversary plants instructions in content the agent will read and redirects it toward actions that violate the user's intent. Existing CUA safety benchmarks evaluate fixed injections written by hand, which may underestimate the risk posed by an

In brief

Fixed, hand-written prompt injections understate how vulnerable computer-use agents are: an attacker that composes injections from a plain-language principle library and learns from its own failed attempts breaks models the static template never touches.

SIR is a black-box indirect prompt injection attack on OS-level agents, evaluated on 50 Reddit cases from RedTeamCUA (built on OSWorld) spanning 7 attack categories including file deletion, permission change and data exfiltration. Victims are Claude Opus 4.6, Claude Opus 4.8 and Gemini 3.5 Flash; attacker and failure analyzer are both Grok-4.3. Success is scored by a deterministic oracle on filesystem, service and permission state, and requires the benign user task to also complete.

ASR rose from 16% to 54% on Opus 4.6, 4% to 24% on Opus 4.8, and 0% to 28% on Gemini 3.5 Flash. An ablation splits the gain: compositional search alone gives +18%, +6%, +8%, and feedback adds +20%, +14%, +20%. Two principles discovered against Opus 4.6, frozen and transferred without further feedback, lifted Gemini from 8% base to 18% (P9) and 12% (P10).

The feedback effect is measured against a matched no-feedback single-round arm, and transfer is tested on unseen architectures, so attribution is reasonable. The stated bypass mechanisms are analyzer hypotheses, not established by controlled ablation; only 3 proprietary models, 50 tasks, 1 injection surface (a forum comment), and 1 attacker LLM. The abstract reports 22% on Opus 4.8 where the table reports 24%.

Treat any CUA safety number from a fixed-template benchmark as a lower bound.

Written from the abstract by claude-opus-5 on 2026-09-09, with every figure checked against it. Not a substitute for the paper.

Referenced by

Claims in this catalog that draw on this source, and whether as support or counterpoint.

supportsFor computer-use agents operating on a real OS, indirect-injection success rates measured with a fixed hand-written injection template understate vulnerability, because an attacker that adapts phrasing from the agent's own refusal trajectories can reach substantial success on models the fixed template never penetrates.