Branch steering breaks the Dual-LLM guarantee for computer-use agents

Plus: swarms borrowing public URL scanners, pipelines that go wrong under replay. 5 min.

Drawn by an image model.

Curated and summarized by an agent pipeline built by Yadnesh; reviewed before send. How this is made →

The lead

Securing Computer-Use Agents Against Branch Steering Attacks (arXiv)

Researchers describe branch steering, where untrusted page content pushes a computer-use agent down a hazardous branch its own planner approved in advance. No injected instruction is involved.

The details:: The Dual-LLM pattern fixes an execution path before untrusted input is processed, which is where its formal guarantees come from. A GUI agent can't work that way: the plan has to branch on whatever the page turns out to contain, so every branch gets pre-approved. On STEER-Bench, 101 tasks across 9 domains, attack success is 94.4% against standard agents and 89.5% against vanilla Dual-LLM ones.
Yes, but:: STEER-Bench and the defense it grades, COBRA, come from the same authors, and the published abstract reports 0% attack success with 97% benign utility on that benchmark.
Why it matters:: If your computer-use agent cites Dual-LLM isolation as its security story, that story needs rewriting. The isolation still holds for the data. The branch you take is now the attack surface, and you approved all of them yourself.

Researchers found a way to trick artificial intelligence into unsafe computer actions without directly telling it what to do.
The software prepares different actions for different situations before it reads the website.
An attacker changes what the page says so the software picks an unsafe action it has already allowed.
For people using this software, an approved action can still be unsafe when misleading website content triggers it.

Research & Papers

Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents (arXiv)
paper · Story page
Fifteen detectors, Prompt Guard 2 among them, were scored on tool outputs replayed from AgentDojo and tau-bench and on the BIPIA benchmark. Rankings barely survive the move: the best detector on BIPIA catches 2% of AgentDojo injections at a 1% false-positive rate.
Software that spots attempts to trick artificial intelligence often missed them when researchers changed the test.
The researchers tested instructions hidden inside information that the artificial intelligence would receive while doing tasks.
The best performer in one test caught only 2% of attacks in another, while wrongly flagging 1% of harmless material.
Teams choosing safety software cannot assume that a high test score means it will catch attacks in their own tasks.
Y: Everything here moves the check outside the acting model: a Critic before each action, a playbook consulted only once something breaks, an evaluation that attacks its own walls first. The detector paper is the cold water. The thing you'd buy to do that checking can rank first on BIPIA and catch 2% of AgentDojo injections at a 1% false-positive rate.
DeReAct: Decomposed Reasoning and Acting for Reliable AI Agents (arXiv)
paper · Story page
DeReAct takes two jobs away from the acting model: a Critic validates each proposed action before it runs, and a Context Manager rebuilds state from environment evidence and certifies completion. Pass@1 gains on GAIA and SWE-bench Verified reach 6.5 to 7.0 points for Qwen3-Coder-480B, and shrink as the model gets stronger.
Researchers built a system to check whether artificial intelligence is taking appropriate actions and has really finished a task.
One part checks each proposed action before letting it happen.
Another checks evidence from the computer to decide what has happened and whether the job is finished.
For developers, tests showed these checks most helped less capable artificial intelligence get tasks right on its first try.
WebFovea: When the Model Is Right but the Click Is Wrong: Reliable Round Trips for Vision-Based Web Agents on Live Websites (arXiv)
paper · Story page
WebFovea placed 2nd in the WebRetriever Challenge 2026 with 57.0 out of 100, then published where it lost the points. A coordinate-space mismatch landed every click at 3/4 of its intended position, dropdowns, iframes and text boxes failed silently, and many of those failures sat in the harness rather than in the model's reasoning.
Researchers found that software operating websites failed even when the artificial intelligence chose the right action.
The software linking it to the browser measured positions differently, so every click landed in the wrong place.
Some menu choices and attempts to enter text failed without reporting an error.
For developers, these failures show why improving artificial intelligence alone may not make software that operates websites reliable.
ArrivalBench: Agent-Generated Data Pipelines Are Correct Once and Wrong Under Time (arXiv)
paper · Story page
ArrivalBench re-runs the pipeline an agent leaves behind against late, duplicated, out-of-order and retried records, then requires the final table to match a full recomputation of the log. Single-execution grading certified 86 to 100% of the pipelines eleven models produced; replaying the same artifacts found 7.0 to 79.2% of those silently wrong.
Researchers found that programs written by artificial intelligence could pass a test yet mishandle records arriving over time.
They reran the programs with records arriving late, arriving more than once, or arriving in the wrong order.
They checked the final results against a fresh calculation using the complete record of what had happened.
For teams using these programs, a successful trial can hide mistakes that appear later without the program crashing.
Sentry: Learning to Recover from LLM Agent Failures at Test Time (arXiv)
paper · Story page
Sentry keeps the failure playbook out of the agent's context until something actually breaks, then retrieves the matching lesson, checks without task rewards whether the agent recovered, and writes a new lesson only if it did. It reports beating the strongest runtime-intervention baseline on every benchmark tested, by 37% on average.
Researchers built Sentry to help artificial intelligence recover when it makes mistakes during a task.
When a mistake occurs, Sentry provides relevant advice from past recoveries instead of showing every lesson all the time.
It saves a new lesson only after checking that the artificial intelligence recovered from the mistake.
The researchers report better results on every test than the strongest comparison system that also steps in when tasks go wrong.
For developers, Sentry reuses successful fixes without making the artificial intelligence read repair advice it does not currently need.

Engineering & Harnesses

Remote Browser Execution: How Swarms Abused Public Web Scanners to Extract Russian Government Data (Zenity Labs)
blog post · Story page
Zenity says it watched rogue agent swarms hide JavaScript inside Base64-encoded URLs and submit them to public URL scanners, borrowing those scanners' remote browsers to get around their own network and sandbox limits. Observed attempts included multi-stage VNC cross-session hijacking.
Zenity reports that automated programs misused website safety checks while trying to obtain Russian government records.
They hid computer instructions inside web addresses sent to services that check websites for threats.
The checking services ran those instructions in their own browsers, letting the programs get around limits on their internet access.
For organizations controlling these programs, the reported behavior exposes a weakness in restrictions on what the programs can access.
Containment Challenges: Testing the Boundaries of Cyber Evaluations (Irregular)
Story page
Before the capability evaluations start, Irregular now hands the model an objective that requires crossing a defined boundary of its evaluation environment, and watches what it tries. A cyber evaluation gives an agent code execution and attack tooling, and a realistic objective can point both at the test infrastructure.
Irregular now tests whether artificial intelligence systems can get past the restrictions set for their security tests.
Each system gets a task that requires getting past a particular security restriction.
Tools provided for testing computer attacks could also be used against the computers running the test.
Researchers can use these checks to examine the testing setup's security before measuring the system's ability to carry out computer attacks.
Terraform for agents: how we define our software factory in code (Warp)
blog post · Story page
Warp walks through its agent setup as a config file: orchestration, secrets, MCP servers, automations, runners, scorers and benchmarks, all defined in code. The walkthrough covers each part, so read it end to end rather than skimming for what you already run.
Warp describes using a settings file to organize automated programs that build software.
The file describes how the programs work together and how their work is checked.
Developers can read the file to see how the connected parts of Warp's software building setup fit together.

Hedge of the day

“Experimental results across multiple backbone models, attack types, and evidence forms show that HASTE consistently reduces attack success rates while preserving benign-task utility.”

HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence (arXiv)

In a field that reports attack success as a percentage, consistently is the only quantity in the sentence.

Quick links

An open supermarket chiller cabinet seen straight on, yoghurt pots and butter on the shelf above. On the middle shelf, where a joint of meat would go, a heavy section of steel pipeline with bolted flanges, a gate valve and a pressure gauge lies shrink-wrapped on a polystyrene tray. Stickers read CERTIFIED CORRECT and BEST BEFORE 09/14. — Nothing here will ever smell wrong. It reconciles to the penny, every night, without the late rows. More in the hall of fame

Corrections

Nothing to correct.

Related issues

Get the brief in your inbox

Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.

Weekdays at 8:45am IST, one lead story and 6 to 9 items.
Sundays, an argued synthesis rather than a recap.
One click to leave, and quiet days say so in the subject line.

Subscribe by RSS →