Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents

Sarthak Choudhary; Mihai Christodorescu; Ashish Hooda; Somesh Jha; Tongxin Li; Damien Octeau

cs.CROct 7, 2026

Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents

Authors: Sarthak Choudhary, Mihai Christodorescu, Ashish Hooda, Somesh Jha, Tongxin Li, Damien Octeau

Organizations: University of Wisconsin–Madison · Google · Google DeepMind

Abstract

Computer-use agents (CUAs) perform tasks across applications (such as desktops, mobile apps, and web browsers) by observing graphical interfaces and issuing commands such as clicks and keystrokes. These interfaces combine trusted controls and content with untrusted content needed for legitimate tasks. An adversary controlling this untrusted content can embed instructions or misleading visual cues to change the agent's intended action or redirect its commands to the wrong interface target. We formalize security requirements for both the agent's decisions and their execution through GUI commands. In an ideal execution model, we show that enforcing both requirements at each step protects execution traces. We instantiate this model in Secure-CUA, our system for secure CUA execution. Its key idea is to commit to an explicit per-action program, called an $\textit{action transaction}$ , before accessing untrusted content. Each transaction fixes its queries to untrusted content and the permitted uses of their responses. The system masks untrusted regions and evaluates each transaction to produce the next action, using an isolated query model to answer its queries. It then locates the intended interface target using the masked interface. Under the model's assumptions, Secure-CUA is secure by design, while generating a new transaction at each step helps maintain high task utility by adapting to changing interfaces. We evaluate Secure-CUA under benign conditions on 400 WebArena tasks using three frontier models across $5$ seeds, yielding $6,000$ execution traces. Secure-CUA achieves an average task success rate of $53.55\%$ , compared with $55.12\%$ for Vanilla-CUA and $13.17\%$ for CaMeL-CUA.

Figures & tables

Symbol	Meaning	Symbol	Meaning
$A$	Computer-use agent.	$\mathrm{Generate}_{A}$	Action generation.
$\mathcal{C}_{A},\mathcal{E},T_{\mathcal{E}}$	Controller; environment; transducer.	$\mathrm{Ground}_{A}$	Visual grounding.
$U,H_{t}$	User instruction; history.	$f_{t}^{\mathsf{end}}$	Extracts endorsed values.
$q_{t},s_{t}$	Controller/environment states.	$z_{t}$	Endorsed values.
$\mathrm{obs},o_{t}$	Observation function and output.	$f_{t}^{\mathsf{act}}$	Permitted action computation.
$o_{t}^{\mathsf{T}},o_{t}^{\mathsf{U}}$	Trusted/untrusted components.	$d_{t}$	Intended application object.

Table 1: Summary of notation.

Figure 1: Conventional and secure CUA execution. The task is to copy a customer review into the Description field. (a) Conventional CUA execution. The agent uses the observation to generate a semantic action and ground it into GUI commands. Untrusted content in this observation may influence either stage, changing the chosen action or redirecting execution to the wrong field. (b) Secure CUA execution. Observation isolation separates trusted and untrusted content. The agent uses trusted context to fix the operation and destination of its action, while bounded endorsement allows the review to supply only the text argument

v

\mathsf{Type}(\text{``Description''},v)

. Visual grounding uses the trusted observation to map this action to GUI commands targeting the Description field.

Figure 2: Secure-CUA execution for the running example. The runtime masks the untrusted review (1), and the actuator commits to an action transaction (2). The interpreter retrieves the review through an isolated query (3) and produces a semantic action carrying a symbolic reference (4). The grounding model locates the description field (5). The runtime resolves the reference and executes the GUI commands (6). The review remains hidden from the actuator and grounding model.

Panel of Figure 3 — Figure 3: Task success rates on 100 tasks per application. We compare Vanilla-CUA, CaMeL-CUA, and Secure-CUA across four WebArena applications and three frontier models. Bars show the mean task success rate (%) over five seeds, with error bars indicating $\pm$ one standard deviation. Opus, Gemini, and GPT denote Claude Opus 5, Gemini 3.8 Flash, and GPT-5.6-Sol, respectively.

	Shopping				GitLab
Model	Vanilla	CaMeL-CUA	Secure-CUA	Act / Grd / Qry	Vanilla	CaMeL-CUA	Secure-CUA	Act / Grd / Qry
Opus	3.57 / 102	1.50 / 290	4.41 / 429	3.43 / 0.40 / 0.58	3.70 / 121	2.36 / 423	4.43 / 415	3.29 / 0.58 / 0.56
Gemini	3.88 / 219	1.63 / 467	3.42 / 483	2.64 / 0.42 / 0.36	4.41 / 109	1.96 / 534	5.12 / 647	3.42 / 1.01 / 0.69
GPT	3.12 / 97	1.34 / 287	3.29 / 314	2.59 / 0.33 / 0.37	2.35 / 127	1.82 / 374	4.45 / 365	3.23 / 0.82 / 0.40
	Postmill				Shopping Admin
Model	Vanilla	CaMeL-CUA	Secure-CUA	Act / Grd / Qry	Vanilla	CaMeL-CUA	Secure-CUA	Act / Grd / Qry

Table 2: Execution overhead. For each application and model, system columns report mean total token consumption (

\times 10^{5}

) / wall-clock time (s) per task, averaged across five seeds. Act / Grd / Qry provides Secure-CUA’s token breakdown for the actuator, grounding model, and isolated query model, respectively, using the same token units.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Abstract CUA execution. The transducer maps semantic action

a_{t}

to GUI commands

\ell_{t}

using the current observation, linking the controller transition

q_{t}\to q_{t+1}

to the environment transition

s_{t}\to s_{t+1}

. The trusted runtime executes the commands and supplies the next observation and updated history to the controller.

Figure 5: Grounding attack on CaMeL-CUA for WebArena task postmill-719. (a) The Python program requests the intended upvote control and clicks the coordinates returned by find. (b) An adversarial moderator notice induces find to return coordinates for another post’s downvote control. The resulting click produces an unintended downvote while preserving the semantic action and executed program branch.

Application	Entries	Examples of untrusted content
Postmill	18	Post titles, bodies, images, authors, and linked hosts; comments, forum descriptions, and user biographies.
Shopping	24	Product names, images, descriptions, specifications, reviews, and marketing content; product information repeated in carts, orders, and confirmation messages.
Shopping Admin	123	Customer and address fields, order records, product names and descriptions, images, reviews, search terms, and newsletter subscriber information.
GitLab	66	Project and user information, issues, merge requests, commit messages, labels, branch and file names, rendered documents, diffs, and editor contents.

Appendix

Table 3: Application-specific labeling rules. The table summarizes rule-file entries and examples of content labeled untrusted.

Constructor	Retrieved-value argument
Click(target, anchor=None)	None.
Type(target, value, anchor=None)	value.
Press(target, key, anchor=None)	None.
Scroll(direction="down", amount=600)	None.
GoBack()	None.
Finish(status="success", answer="")	answer.

Appendix

Table 4: Semantic-action constructors. The table lists the transaction interface and arguments that may carry retrieved values. Other arguments are subject to the literal and region-identifier constraints described in the text.

Action	Runtime behavior
Click	Click the validated coordinates.
Type	Focus the validated field, select its contents, and insert the bound text.
Press	Focus the validated control and issue the key command fixed in the transaction.
Scroll	Scroll in the direction and by the amount fixed in the transaction.
GoBack	Request browser back navigation.
Finish	Resolve the final answer and terminate execution.

Appendix

Table 5: Runtime dispatch. The runtime translates admitted semantic actions into the following browser operations or execution outcomes.

Model	Metric	Shopping	GitLab	Postmill	Shopping Admin	All
Opus	Transactions (%)	$23.4$	$27.1$	$22.0$	$12.3$	$20.8$
	Queries/task	$10.5$	$9.7$	$16.7$	$6.3$	$10.8$
	Structured (%)	$74.2$	$72.4$	$24.6$	$24.3$	$47.4$
	String (%)	$25.8$	$27.6$	$75.4$	$75.7$	$52.6$
Gemini	Transactions (%)	$23.1$	$25.4$	$21.8$	$11.8$	$20.2$
	Queries/task	$10.2$	$23.1$	$15.5$	$4.6$	$13.4$

Appendix

Table 6: Access to untrusted information. Transactions is the percentage issuing at least one query; Queries/task is the mean per run. Structured and String are percentages of query calls. All pools counts across the four applications. Percentages are rounded independently.

Explore similar work

Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability
May 8, 2026Zejian Chen, Zhanyuan Liu, Chaozhuo Li +6Computer-Use Agents Agentic Deployments
Beijing University of Posts and Telecommunications, Beijing, China · China Unicom, Beijing, China · China Academy of Information and Communications Technology, Artificial Intelligence Institute, Beijing, China
When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents
Feb 9, 2026Yuting Ning, Jaylen Jones, Zhehao Zhang +5Computer-Use Agents Artificial Intelligence Detection
The Ohio State University · Amazon AGI
Beyond Task Completion: Training Capable and Safe Computer-Use Agents
Aug 27, 2026Zeyu Kang, Zhenyun Yin, Yang Zhang +5Computer-Use Agents Autonomous Agents
Shanghai Artificial Intelligence Laboratory · Harbin Institute of Technology · Fudan University +2

May 8, 2026, cs.CLJ/K move · Enter open · S save

Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability

Zejian Chen, Zhanyuan Liu, Chaozhuo Li, Mengxiang Han+5

Beijing University of Posts and Telecommunications, Beijing, China · China Unicom, Beijing, China · China Academy of Information and Communications Technology, Artificial Intelligence Institute, Beijing, China

Computer-Use Agents Agentic Deployments Security Autonomous Agents Lifecycle

Open paper AskPDF arXiv

Computer-use agents(CUAs)are moving frombounded benchmarks toward real software environments, wherethey operate browsers, desktops, mobile applications, flesystems,terminals, and tool backends. In such settings, reliability isno longer captured by task success alone: perception errors,planning drift, memory use, tool mediation, permission scope,and runtime oversight jointly determine whether agent actionsremain aligned with user intent, Existing surveys organize theCUA landscape by methods, platforms, benchmarks, or securitythreats, but less explicitly connect capability formation, author-ity exposure, failure manifestation, and control placement. Toaddress this gap, the article develops an architecture-lifecycleframework for deployment-grounded reliability in CUAs. Thearchitectural view analyzes Perception, Decision, and Executionas coupled layers that transform software observations intoauthority-bearing actions, The lifecycle view examines Creation.Deployment, Operation, and Maintenance as stages in which priorsare learned, tools and permissions are bound, runtime trajecto.ries are stressed, and assurance must be preserved under drift.Using this lens, the analysis synthesizes representative systems,benchmarks, and security/privacy studies; distinguishes wherefailures become visible from where their enabling conditions areintroduced, and maps recurring intervention surfaces for controloversight, and assurance. OpenClaw is used only as a public moti.vating example of an open deployment pattern, not as a verifedinternal case study. The conclusion highlights open challengesin controllable grounding, long-horizon constraint preservation,safe authority binding, mixed-trust runtime defense, privacy-preserving memory,and continual assurance.

Abstract

Explore similar work

Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability

When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents

Beyond Task Completion: Training Capable and Safe Computer-Use Agents