Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents
2026-08-03 • Computer Vision and Pattern Recognition
Computer Vision and Pattern Recognition
AI summaryⓘ
The authors studied how computer programs that use AI to control computers and websites can be tricked by sneaky commands that look harmless, like starring a project or installing software. Usually, a human confirms important actions to keep things safe, but these low-risk-looking commands slip past both the AI's defenses and human checks. They created II-Bench, a test set of tricky tasks, and HITLCUA, a testing system that mimics real computers and human approval. Their tests showed that these subtle, 'invisible ink' threats are a real problem because current safety measures often miss them.
Computer-Use AgentsLarge Language ModelsPrompt Injection AttacksHuman-in-the-LoopInvisible Ink ThreatsAdversarial TasksInformation ExfiltrationCode ExecutionDockerVirtual Machines
Authors
Jia-Chen Zhang, Ze-Yu Zhang, Kai-Wei Zhang
Abstract
Computer-use agents (CUAs), which empower large language models to autonomously operate operating systems and the web, are increasingly vulnerable to indirect prompt injection attacks. A widely adopted defense is the human-in-the-loop paradigm, in which the agent pauses for explicit user confirmation before executing sensitive operations. While effective against conspicuously high-harm attacks, this defense offers little protection against what we term Invisible Ink Threats: low-harm injected goals, such as starring a repository or installing a package, that are behaviorally indistinguishable from legitimate task execution and thus evade both model safety mechanisms and human oversight. To systematically investigate this blind spot, we present II-Bench, a collection of seemingly harmless adversarial tasks. II-Bench comprises 444 examples targeting confidentiality and integrity attacks across three platforms, spanning three attack categories: page navigation and interaction, sensitive information exfiltration, and code download and execution. Each category is instantiated in both natural language and code forms under two levels of instruction specificity. Furthermore, we construct HITLCUA, a comprehensive adversarial testing framework that integrates a real virtual machine operating system environment with isolated Docker-based web platforms, and simulates human participation by allowing CUAs to consult an API-simulated user before proceeding with suspicious operations. Extensive evaluations of leading CUAs reveal that low-harm injections frequently bypass both agent defenses and simulated user review, exposing severe and previously underexplored security risks in current CUAs.