COBRA Architecture Cuts Branch Steering Attack Success from 94.4% to 0% While Retaining 97% Benign Utility

The paper identifies and systematically characterizes branch steering attacks: because CUA interaction is inherently dynamic in graphical environments, plans cannot remain data-independent and must branch based on anticipated runtime web content, so an adversary can craft untrusted data to steer the agent into a hazardous, pre-approved branch without injecting explicit instructions. The Dual-LLM pattern was previously the primary system-level architecture offering formal security guarantees, using an isolated Planner LLM (P-LLM) to fix execution paths before processing untrusted inputs via a Quarantined LLM (Q-LLM); the work shows these guarantees break down in graphical environments and introduces branch steering as a distinct attack surface. The paper evaluates on STEER-Bench, covering 101 tasks across 9 domains, and reports 94.4% attack success against standard CUAs and 89.5% against vanilla Dual-LLM CUAs, indicating the attack surface is highly effective against both agent types.

The paper proposes COBRA, an architecture that pairs trusted branching plans with ahead-of-time capability constraints, strictly bounding the parameters and destinations each branch may execute. Unlike Dual-LLM, which relies on isolating planning from untrusted input, COBRA constrains capability at the branch level in advance, so a branch that is steered into cannot execute hazardous parameters and destinations. On STEER-Bench, COBRA reduces attack success to 0% while retaining 97% benign utility, indicating the protection does not come at the cost of normal task completion.

The paper provides STEER-Bench, a reusable benchmark of 101 tasks across 9 domains for measuring branch steering attacks and corresponding defenses. Previously there was no systematic evaluation suite for this attack surface; the benchmark allows attack success and benign utility to be measured against the same task set. The benchmark's scale and domain coverage are stated in the abstract, and both attack and defense results are reported on it, forming comparable evaluation conditions.

The result targets Computer Use Agents that directly interact with graphical user interfaces and execute third-party web tools, and applies to deployment settings where execution-path safety must be maintained while processing untrusted pages and tool responses. COBRA assumes a trusted branching plan exists and that capability constraints can be set for each branch ahead of time, so its scope is task shapes whose branches, parameters, and destinations can be enumerated in advance. STEER-Bench covers 101 tasks across 9 domains, providing comparable attack and defense evaluation conditions for follow-up work and allowing attack success and benign utility to be measured on the same task set.

The abstract reports aggregate attack success and benign utility numbers but does not detail the per-domain distribution of STEER-Bench, how tasks are constructed, or the criteria used for judgment, nor does it describe the process and human cost of setting capability constraints in COBRA. The 0% attack success and 97% benign utility are obtained under this benchmark and the evaluated agent configurations, and generalization to other interfaces, tool ecosystems, or longer interaction chains still requires further validation. Readers who need implementation details and reproduction conditions should consult the method and experiment sections of the original paper.