# Dual-LLM Pattern

Computer-use agents that act directly on graphical interfaces must branch on runtime web content, so an adversary can craft untrusted data that pushes the agent into a hazardous pre-approved branch without injecting explicit instructions. STEER-Bench measures this branch steering across 101 tasks in 9 domains, with 94.4% attack success against standard agents and 89.5% against vanilla Dual-LLM. COBRA pairs trusted branching plans with ahead-of-time capability constraints that bound each branch's parameters and destinations, cutting attack success to 0% while retaining 97% benign utility.

Computer-use agents that act directly on graphical interfaces must branch on runtime web content, so an adversary can craft untrusted data that pushes the agent into a hazardous pre-approved branch without injecting explicit instructions. STEER-Bench measures this branch steering across 101 tasks in 9 domains, with 94.4% attack success against standard agents and 89.5% against vanilla Dual-LLM. COBRA pairs trusted branching plans with ahead-of-time capability constraints that bound each branch's parameters and destinations, cutting attack success to 0% while retaining 97% benign utility.