Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of computer-use agents (CUAs) to indirect prompt injection attacks, specifically focusing on "Invisible Ink Threats" that involve low-harm injected goals indistinguishable from legitimate tasks. The authors introduce II-Bench, a benchmark comprising 444 adversarial tasks that target confidentiality and integrity across various platforms, and develop HITLCUA, a testing framework that simulates human oversight in a controlled environment. The findings reveal that leading CUAs often fail to detect these low-harm injections, highlighting significant security risks that current defenses do not address.
Invisible Ink Threats can bypass existing safety mechanisms, exposing CUAs to severe security vulnerabilities through seemingly harmless tasks.
Computer-use agents (CUAs), which empower large language models to autonomously operate operating systems and the web, are increasingly vulnerable to indirect prompt injection attacks. A widely adopted defense is the human-in-the-loop paradigm, in which the agent pauses for explicit user confirmation before executing sensitive operations. While effective against conspicuously high-harm attacks, this defense offers little protection against what we term Invisible Ink Threats: low-harm injected goals, such as starring a repository or installing a package, that are behaviorally indistinguishable from legitimate task execution and thus evade both model safety mechanisms and human oversight. To systematically investigate this blind spot, we present II-Bench, a collection of seemingly harmless adversarial tasks. II-Bench comprises 444 examples targeting confidentiality and integrity attacks across three platforms, spanning three attack categories: page navigation and interaction, sensitive information exfiltration, and code download and execution. Each category is instantiated in both natural language and code forms under two levels of instruction specificity. Furthermore, we construct HITLCUA, a comprehensive adversarial testing framework that integrates a real virtual machine operating system environment with isolated Docker-based web platforms, and simulates human participation by allowing CUAs to consult an API-simulated user before proceeding with suspicious operations. Extensive evaluations of leading CUAs reveal that low-harm injections frequently bypass both agent defenses and simulated user review, exposing severe and previously underexplored security risks in current CUAs.
