"What Did It Actually Do?": Understanding Risk Awareness and Traceability for Computer-Use Agents

Zifan Peng; Mingchen Li

cs.CRMar 30, 2026

"What Did It Actually Do?": Understanding Risk Awareness and Traceability for Computer-Use Agents

Authors: Zifan Peng, Mingchen Li

Organizations: The Hong Kong University of Science and Technology (Guangzhou), China · University of North Texas, The United States

Abstract

Personalized computer-use agents are rapidly moving from expert communities into mainstream use. Unlike conventional chatbots, these systems can install skills, invoke tools, access private resources, and modify local environments on users' behalf. Yet users often do not know what authority they have delegated, what the agent actually did during task execution, or whether the system has been safely removed afterward. We investigate this gap as a combined problem of risk understanding and post-hoc auditability, using OpenClaw as a motivating case. We first build a multi-source corpus of the OpenClaw ecosystem, including incidents, advisories, malicious-skill reports, news coverage, tutorials, and social-media narratives. We then conduct an interview study to examine how users and practitioners understand skills, autonomy, privilege, persistence, and uninstallation. Our findings suggest that participants often recognized these systems as risky in the abstract, but lacked concrete mental models of what skills can do, what resources agents can access, and what changes may remain after execution or removal. Motivated by these findings, we propose AgentTrace, a traceability framework and prototype interface for visualizing agent actions, touched resources, permission history, provenance, and persistent side effects. A scenario-based evaluation suggests that traceability-oriented interfaces can improve understanding of agent behavior, support anomaly detection, and foster more calibrated trust.

Figures & tables

Figure 1. Problem framing of this paper. Users delegate tasks and authority to personalized computer-use agents through skills, tutorials, and setup choices, yet the agent’s execution can remain opaque across files, tools, network access, and persistent system changes. We propose AgentTrace, a traceability-oriented interface that makes actions, touched resources, permissions, provenance, and residual side effects legible after task execution.

Figure 2. Conceptual decomposition of a personalized computer-use agent. Such systems combine mixed-trust inputs, an agent core, execution surfaces, persistent state, extensibility mechanisms, and user-visible outputs. This structure helps explain why users may struggle to understand what the agent can access, what it changed, and what remains after task execution.

Stage	Main Surface	Exposed Assets	Triggering Conditions	User-Facing Consequences
Pre-installation awareness	News, tutorials, peer recommendation, paid setup services	Trust, decision quality, account access delegated to helpers	Urgency narratives, fear of missing out, low technical confidence	Adoption before clear understanding of what the system can access or modify
Installation and onboarding	Skills, plugins, dependency setup, setup guides	Files, credentials, future execution surface	One-command install, third-party skills, natural-language onboarding	Users import capability bundles without clearly understanding whether they execute code, install dependencies, or expand authority
Configuration and capability binding	Filesystem scope, browser profiles, channels, keys, nodes, sandbox settings	Concrete local and connected resources	Broad defaults, convenience setup, weak isolation, channel binding	Users cannot easily judge what the agent is actually authorized to touch in a given deployment
In-use execution	Tool invocation, mixed-trust content, autonomous planning	Files, browser state, services, messages, local environment	Local task execution, external content, skill-defined steps, multi-step continuation	Users see task progress but may not notice side effects, risky operations, or escalation of scope
Post-use persistence and recovery	Logs, memory, installed dependencies, config changes, residual services	Persistent state, privacy, environment integrity	Task completion, uninstall attempts, later troubleshooting	Users are unsure what changed, what remains, and whether the system has been fully removed or requires remediation

Table 1. Lifecycle-oriented risk taxonomy for personalized computer-use agents. The taxonomy connects ecosystem evidence, user-facing confusion points, and system-level consequences across five stages of delegated authority.

Figure 3. AgentTrace , our traceability-oriented prototype for personalized computer-use agents. The interface combines five coordinated views for post-hoc auditing: a task timeline, a resource touch map, a permission and authority history, an action provenance inspector, and a persistent change summary. Together, these views help users reconstruct what the agent did, what it touched, under what authority it acted, why actions occurred, and what residual changes remained after execution.

Figure 4. AgentTrace turns opaque agent execution into post-hoc audit support. Starting from a high-level user request, personalized computer-use agents may perform multi-step operations involving tools, imported skills, external content, and persistent system changes. AgentTrace organizes this behavior into five coordinated views—task timeline, resource touchpoints, permission history, action provenance, and persistent change summary—to help users reconstruct what happened and determine whether follow-up review or remediation is needed.

Measure	Baseline	AgentTrace	Statistical test
Comprehension accuracy (%)	61.3	84.7	$W=70.5$ , $p=.003$ , $r=.78$
Risk / anomaly detection (0–5)	2.1	3.8	$W=66.0$ , $p=.005$ , $r=.73$
Recovery-planning score (0–4)	1.6	3.4	$W=72.0$ , $p=.002$ , $r=.81$

Table 2. Objective performance in the evaluation study. Higher is better for all measures.

Measure	Baseline	AgentTrace	Statistical test
Perceived understanding	3.6	5.9	$W=74.0$ , $p=.001$ , $r=.84$
Perceived control	3.4	5.8	$W=71.0$ , $p=.002$ , $r=.80$
Confidence in judging safety	3.1	5.4	$W=68.0$ , $p=.004$ , $r=.76$
Calibrated trust judgment	3.3	5.2	$W=63.5$ , $p=.008$ , $r=.69$

Table 3. Subjective ratings on 7-point Likert scales. Higher is better for all measures.

Computer-Use Agent Safety

See all 20 papers

Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?
Jun 22, 2026Anmol Goel, Iryna GurevychComputer-Use Agents Contextual Integrity
Ubiquitous Knowledge Processing Lab (UKP Lab), Department of Computer Science, TU Darmstadt and National Research Center for Applied Cybersecurity ATHENE
SkillAtlas: An Attack Trace Library for Agent Skills
Sep 11, 2026Yuxin Tian, Zenghao Duan, Liang Pang +2LLM Agent Security Agent Skill Security Auditing
State Key Laboratory of AI Safety, Institute of Computing Technology, CAS · University of Chinese Academy of Sciences
A Systematic Security Evaluation of OpenClaw and Its Variants
Apr 3, 2026Yuhang Wang, Haichang Gao, Zhenxing Niu +4AI Agent Security LLM Agent Security
Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom

Jun 22, 2026J/K move · Enter open · S save

Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?

Anmol Goel, Iryna Gurevych

Ubiquitous Knowledge Processing Lab (UKP Lab), Department of Computer Science, TU Darmstadt and National Research Center for Applied Cybersecurity ATHENE

Computer-Use Agents Contextual Integrity AI Agent Security Benchmarks Data Leakage AI Agent Security AI Agent Safety+1

Open paper AskPDF arXiv

Computer-use agents (CUAs) now act on a user's behalf across personal applications such as email, calendars, and to-do lists. This cross-application access is useful, but it also creates a privacy risk that has been largely overlooked: when an agent works in one context, it can pull in information from another that is inappropriate in that context. Hence, we introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios. We target three common failure modes in CUAs: visual co-location, where the agent pulls in prohibited items that sit next to the task target in the UI; task-ambiguity overshare, where the agent dumps dense personal state in response to an under-specified prompt; and recipient misalignment, where the agent sends content to an addressee for whom it is inappropriate. We evaluate 15 frontier agents and find a surprisingly high failure rate: 11 of 15 leak on more than 50% of scenarios, with an average leakage of 67.9%, and the same failures persist when agents act end-to-end in the environment to complete the task. We release AgentCIBench to encourage the development of safer computer-use agents and position contextual disclosure testing as a pre-deployment safety check.

Abstract

Computer-Use Agent Safety

Explore similar work

Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?

SkillAtlas: An Attack Trace Library for Agent Skills

A Systematic Security Evaluation of OpenClaw and Its Variants