{"slug": "securing-computer-use-agents-against-branch-steering-attacks", "title": "Securing Computer-Use Agents Against Branch Steering Attacks", "summary": "A 2 October 2026 arXiv paper introduces STEER-Bench, a 101-task benchmark across 9 domains, and reports that branch steering attacks succeed against 94.4% of standard Computer Use Agents and 89.5% of vanilla Dual-LLM CUAs. The authors propose COBRA, an architecture pairing trusted branching plans with ahead-of-time capability constraints that bound each branch's parameters and destinations, which cuts attack success to 0% on STEER-Bench while retaining 97% benign utility.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 2 Oct 2026]\n\n# Title:Securing Computer-Use Agents Against Branch Steering Attacks\n\n[View PDF](https://arxiv.org/pdf/2610.03089)\n\n[HTML (experimental)](https://arxiv.org/html/2610.03089v1)\n\nAbstract:Modern Computer Use Agents (CUAs) directly interact with graphical user interfaces and execute third-party web tools, exposing them to indirect prompt injection across every rendered page and tool response. While the Dual-LLM pattern is the primary system-level architecture offering formal security guarantees - using an isolated Planner LLM (P-LLM) to fix execution paths before processing untrusted inputs via a Quarantined LLM (Q-LLM) - these guarantees break down in graphical environments. Because CUA interaction is inherently dynamic, plans cannot remain data-independent; they must branch based on anticipated runtime web content - covering all possible cases the agent may encounter. This exposes agents to branch steering attacks, where an adversary crafts untrusted data to coerce a CUA down a hazardous, pre-approved branch without injecting explicit instructions. We systematically study branch steering attacks and introduce STEER-Bench (101 tasks across 9 domains), showing high attack success against both standard (94.4%) and vanilla Dual-LLM (89.5%) CUAs. We then propose COBRA, an architecture that pairs trusted branching plans with ahead-of-time capability constraints, strictly bounding the parameters and destinations each branch may execute. On STEER-Bench, COBRA reduces attack success to 0% while retaining 97% benign utility.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/securing-computer-use-agents-against-branch-steering-attacks", "canonical_source": "https://arxiv.org/abs/2610.03089", "published_at": "2026-10-05 09:07:08+00:00", "updated_at": "2026-10-05 09:22:38.191228+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-research", "large-language-models", "artificial-intelligence"], "entities": ["STEER-Bench", "COBRA", "Computer Use Agents", "Dual-LLM", "Planner LLM", "Quarantined LLM", "arXiv"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/securing-computer-use-agents-against-branch-steering-attacks", "markdown": "https://wpnews.pro/news/securing-computer-use-agents-against-branch-steering-attacks.md", "text": "https://wpnews.pro/news/securing-computer-use-agents-against-branch-steering-attacks.txt", "jsonld": "https://wpnews.pro/news/securing-computer-use-agents-against-branch-steering-attacks.jsonld"}}