Browser agents can be steered down pre-approved branches: 94.4% attack success on STEER-Bench, 0% with COBRA

When computer-use agents execute third-party web tools inside graphical interfaces, the attack surface extends from explicit instruction injection to branch selection itself: an adversary only needs the agent to land in an already-approved hazardous branch. The Dual-LLM pattern originally fixed execution paths with an isolated Planner LLM before untrusted input was processed, providing system-level security guarantees; in graphical environments plans must branch on anticipated runtime web content, and those guarantees break down. STEER-Bench spans 101 tasks across 9 domains, with 94.4% attack success against standard computer-use agents and 89.5% against vanilla Dual-LLM.

COBRA keeps branching plans trusted and attaches ahead-of-time capability constraints to each branch, strictly bounding the parameters and destinations that branch may execute. The earlier Dual-LLM pattern constrained only the isolation between plan and untrusted data, not the parameters and destinations callable inside a branch. On the same STEER-Bench, COBRA reduces attack success to 0% while retaining 97% benign utility.

This report draws on summary-level information and does not cover the complete paper. The demonstrated scope is 9 domains and 101 tasks in STEER-Bench, evaluated on standard computer-use agents, vanilla Dual-LLM, and the COBRA architecture. It is intended for researchers and engineers working on agent security architecture.

The summary reports attack success and benign utility only on STEER-Bench and does not describe behavior outside that benchmark; 0% and 97% are results in this setting and do not yet guarantee other deployment scenarios.