Securing Computer-Use Agents Against Branch Steering Attacks

Giulio Zingrillo , Hanna Foerster , Ilia Shumailov , Yiren Zhao , Robert Mullins

🏛 Institutions: ETH , University of Cambridge , AI Sequrity Company , Imperial College London
📅 Date: October 2, 2026
📑 Publisher: NeurIPS 2026 Workshop on Agents in the Wild
💻 Env: Web
🔑 Keywords: STEER-Bench COBRA benchmark security indirect prompt injection branch steering

TLDR

Studies branch steering attacks, in which untrusted page content pushes a computer-use agent down a hazardous but pre-approved branch of a Dual-LLM plan without injecting explicit instructions, and introduces STEER-Bench (101 tasks across 9 domains) to measure them. Proposes COBRA, which pairs trusted branching plans with ahead-of-time capability constraints on the parameters and destinations each branch may use; it reduces attack success on STEER-Bench to 0% while retaining 97% benign utility.

Open paper Code Report issue