The BasePeople

Dominik Seip

Tübingen AI Center, University of Tübingen

Titles as the sources gave them. In 1 entry, with 5 checked quotations.

What they said

Newest first. Each quotation was found word for word in the source.

“SA-CUA maintains much higher utility than CaMeL-CUA while keeping the attack success rate at zero.”
Towards Safe Autonomy for Computer UsearXiv, October 13, 2026. Speaking as: Other. Abstract: the headline comparison with CaMeL-CUA, an earlier defence adapted to computer-use agents. The zero is measured on the authors' own attack tests.
“The unprotected CUA has low ASR on WASP† (4.8% and 7.1%), but high ASR of 46.2% and 38.5% for RTC† tasks and 43.6% and 38.5% for value injections in RTC-value.”
Towards Safe Autonomy for Computer UsearXiv, October 13, 2026. Speaking as: Other. Section 5: attack success rate (ASR) of the unprotected agent on three suites, for two planner models (Qwen3.8-27B and GPT-5.6-Luna). RTC-value is the authors' new suite.
“SA-CUA loses utility on both suites, completing 30.6% and 38.9% on OSWorld vs. 58.3% for both CUAs, and 50.5% and 49.5% on UCM-B vs 90.9% and 91.9%. Several OSWorld and UCM-B tasks require reading and acting upon untrusted information that cannot be verified. SA-CUA cannot complete these tasks without giving up its guarantees or requiring user confirmation.”
Towards Safe Autonomy for Computer UsearXiv, October 13, 2026. Speaking as: Other. Section 5, 'Retained utility': completion on injection-free tasks (36 OSWorld and 99 UCM-B tasks), two planner models, against an unprotected agent.
“Claude Opus 5 resists all (0/10 attacks succeed) while completing all benign tasks (10/10). Claude Sonnet 5 is hijacked in 2/10 tasks, both times by a phishing e-mail from a lookalike sender: it sends the requested sales report to the impersonator instead of the colleague, so the attack succeeds and the benign task fails.”
Towards Safe Autonomy for Computer UsearXiv, October 13, 2026. Speaking as: Other. Section 5: side test on 10 hard tasks chosen by the authors, run through the Claude computer use API with default safety classifiers.
“SA-CUA guarantees integrity against external manipulation but no confidentiality, so the agent could still disclose confidential information, for example in a public Reddit post.”
Towards Safe Autonomy for Computer UsearXiv, October 13, 2026. Speaking as: Other. Section 6, the authors' first stated limitation.

In the Base

Every entry they appear in.

  1. ResearcharXivWrote it

    Towards Safe Autonomy for Computer Use

    Researchers at the University of Tübingen present SA-CUA, a design for AI agents that operate a computer from screenshots: the planning model sees only screen regions judged trustworthy, and values from untrusted content are checked first. On the authors' tests, no injected attack succeeded, though SA-CUA completed fewer injection-free benchmark tasks than an unprotected agent.