The BaseResearcharXiv
Towards Safe Autonomy for Computer Use
Researchers at the University of Tübingen present SA-CUA, a design for AI agents that operate a computer from screenshots: the planning model sees only screen regions judged trustworthy, and values from untrusted content are checked first. On the authors' tests, no injected attack succeeded, though SA-CUA completed fewer injection-free benchmark tasks than an unprotected agent.
Why it matters
The same thing, for different readers.
What it means for you
AI that operates your computer can be tricked by text planted in a web page or email; this design blocked every planted attack in tests but finished fewer tasks.
For lawmakers
Zero attack success was measured on the authors' own tests under stated assumptions; the paper argues for security built into system design, not training or filters, at a utility cost.
For researchers
Unmasks trusted screen regions via the accessibility tree and checks untrusted values against trusted sources. New value-substitution attacks get past type limits; over-masking and extra token cost remain.
The question it raises
Who should an AI trust, and why? Here only the user, the app's own interface and listed sources count; anything else must be checked before the AI acts on it.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“SA-CUA maintains much higher utility than CaMeL-CUA while keeping the attack success rate at zero.”
Found word for word in the source
“The unprotected CUA has low ASR on WASP† (4.8% and 7.1%), but high ASR of 46.2% and 38.5% for RTC† tasks and 43.6% and 38.5% for value injections in RTC-value.”
Found word for word in the source
“SA-CUA loses utility on both suites, completing 30.6% and 38.9% on OSWorld vs. 58.3% for both CUAs, and 50.5% and 49.5% on UCM-B vs 90.9% and 91.9%. Several OSWorld and UCM-B tasks require reading and acting upon untrusted information that cannot be verified. SA-CUA cannot complete these tasks without giving up its guarantees or requiring user confirmation.”
Found word for word in the source
“Claude Opus 5 resists all (0/10 attacks succeed) while completing all benign tasks (10/10). Claude Sonnet 5 is hijacked in 2/10 tasks, both times by a phishing e-mail from a lookalike sender: it sends the requested sales report to the impersonator instead of the colleague, so the attack succeeds and the benign task fails.”
Found word for word in the source
“SA-CUA guarantees integrity against external manipulation but no confidentiality, so the agent could still disclose confidential information, for example in a public Reddit post.”
Found word for word in the source
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- SA-CUA splits the work between a privileged AI model that plans while seeing only screen regions judged trustworthy (rules derived from the accessibility tree decide what is unmasked) and a quarantined model that reads untrusted content. A value taken from untrusted content is used only after a deterministic check against trusted sources. It was run in virtual machines against an unprotected computer-use agent and against CaMeL-CUA, with Qwen3.8-27B and GPT-5.6-Luna as planners, on adversarial tasks (42 adapted from WASP, 65 from RedTeamCUA, and 78 new value-substitution tasks, on self-hosted copies of GitLab, Reddit, OwnCloud, RocketChat and Thunderbird) and on injection-free tasks (36 OSWorld, 99 UCM-B). Success is checked from environment state. A side test ran 10 tasks the authors consider hard through the Claude computer use API.
- What it found
- Attack success (Qwen3.8-27B / GPT-5.6-Luna): unprotected agent 4.8% / 7.1% on the WASP-based tasks, 46.2% / 38.5% on the RedTeamCUA-based tasks and 43.6% / 38.5% on the value-substitution tasks; CaMeL-CUA and SA-CUA 0% throughout. Under attack SA-CUA completed 86.2% / 81.5% of the RedTeamCUA-based tasks (CaMeL-CUA 18.5% / 27.7%; unprotected 95.4% / 98.5%). With no attack it completed 30.6% / 38.9% of OSWorld tasks and 50.5% / 49.5% of UCM-B tasks, against 58.3% and 90.9% / 91.9% for the unprotected agent, and with GPT-5.6-Luna it used 7.5 times the tokens of the unprotected agent (4.2 times with prompt caching). Its screen labelling, tested on 160 hand-labelled captures, left no untrusted free-text row unmasked, but masked 76.9% (rules proposed by Qwen3.8-27B) and 56.3% (GPT-5.6-Luna) of trusted rows on web captures. In the 10-task side test through the Claude computer use API, Claude Opus 5 resisted all 10 attacks; Claude Sonnet 5 was hijacked in 2, both by a phishing email from a lookalike sender.
- What it does not show
- The authors state that SA-CUA guarantees integrity against outside manipulation but not confidentiality (an agent could still disclose private information, for example in a public post); that some tasks cannot be done safely because the needed condition can be checked only in untrusted content; that it fails when a task does not say which value to verify; and that it is an open question whether its long system prompt could be shortened by training. By design: the user must supply an allowlist of trusted web domains and contacts, attacks on trusted sources are excluded, GitHub is treated as a trusted reference, all attacks run in sandboxed copies of sites, one of the three attack suites (RTC-value) is the authors' own, task sets are small (36 OSWorld tasks), and results cover two planner models. The side test used 10 tasks chosen as hard and is not a general measure of any model's robustness.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice? · Can AI systems act beyond what people intended or allowed?
- People
- Dominik Seip (Wrote it, Tübingen AI Center, University of Tübingen) · Bartol Markovinović (Wrote it, Tübingen AI Center, University of Tübingen) · Matthias Hein (Wrote it, Tübingen AI Center, University of Tübingen)
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 14, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “Towards Safe Autonomy for Computer Use”, October 13, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-13-safe-autonomy-for-computer-use
Our notesPreprint, not peer reviewed (arXiv v1, 13 Oct 2026). Full text read from the arXiv HTML version, not the PDF, so no lost-ligature problem. Quotes are co-authored paper text; speaker set to the first author per the run rule. Claude Opus 5 and Claude Sonnet 5 (via the Claude computer use API) are test subjects in a 10-task side test, and Anthropic's computer-use tool is cited as a deployed example; the paper's subject is SA-CUA, so conflict is false and anthropic is left out of orgs. The summary does not name them; the result is in the evidence block and one quotation. Check: the number of repeated runs (k) behind the attack success rates is garbled in the HTML Table 1, so we do not state it; the paper counts a task as attacked if any of k runs succeeded. Every figure in the evidence block also appears in the paper's running text. The affiliation line follows the author block and is applied to all three authors (Seip's email is at the university). 'Guarantee' language in the paper refers to its threat model; we report measured attack success only.