Metraipolis › archive › dc_bb46bb100733

StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection — arXiv:2608.06477

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.06477
License (as archived): CC0-1.0
Archived: 2026-10-19T09:47:07.188Z
SHA-256 of the archived text: 2d8b794434e35bddd11cf4096a2acb777a1af89c20418eaa4b57a10983c1c3d9
Stable URL of this page: https://metraipolis.com/documento/dc_bb46bb100733

How to cite

StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection — arXiv:2608.06477 — arXiv (en), https://arxiv.org/abs/2608.06477 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bb46bb100733 (Metraipolis archive dc_bb46bb100733, sha256 2d8b794434e35bddd11cf4096a2acb777a1af89c20418eaa4b57a10983c1c3d9)

BibTeX

@misc{dcbb46bb100733,
  title = {StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection — arXiv:2608.06477},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.06477},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bb46bb100733; sha256 2d8b794434e35bddd11cf4096a2acb777a1af89c20418eaa4b57a10983c1c3d9},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.06477. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Computer-use agents (CUAs) face a growing threat from indirect prompt injection, where adversarial instructions are planted in the environment such as web pages. In this paper, we introduce multi-step indirect prompt injection, a new attack class against CUAs in which the adversarial goal is decomposed into multiple innocuous-looking sub-steps and distributed across a chain of pages referenced along the agent's navigation path. We develop a pipeline to automatically decompose an adversarial goal under the constraint that the execution of the decomposed sub-steps must achieve the original goal while optimizing the innocuousness of each decomposed sub-step. With this pipeline, we build StepJack, a CUA safety benchmark with 480 test examples. On this benchmark, we evaluate six state-of-the-art CUAs and find that at a fixed decomposition depth, multi-step attacks raise attack success rate (ASR) on three of six CUAs, by up to 31.2 points (e.g., GPT-5.4-mini: 41.7% at single-step to 72.9% at three-step); averaged over the five CUAs that can reliably follow the reference chain (all but EvoCUA-32B), ASR rises from 31.3% at single-step to 36.9% at three-step. Dataset and code are available at this https URL .

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-10 in cs.CL).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Computation and Language (cs.CL).
Pagina del lavoro: https://arxiv.org/abs/2608.06477 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-19T09:46:37.255Z dalla pagina https://arxiv.org/catchup/cs.CL/2026-08-10?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).