StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection

2026-08-06

AI Summary

This study addresses the emerging threat of multi-step indirect prompt injection attacks against computer-using agents (CUAs). The authors propose and implement a novel attack paradigm that decomposes malicious objectives into multiple benign sub-steps using an adversarial goal decomposition algorithm, embedding them across distributed web pages to evade existing defenses. To evaluate this vulnerability, they construct StepJack, a security benchmark comprising 480 samples, and develop an automated testing framework to assess mainstream CUAs. Experimental results demonstrate that a three-step attack increases the success rate of certain models—such as GPT-4o-mini—by 31.2 percentage points (from 41.7% to 72.9%), raising the average success rate across models from 31.3% to 36.9%. These findings reveal systemic security weaknesses in CUAs when navigating complex task trajectories.

Abstract

Computer-use agents (CUAs) face a growing threat from indirect prompt injection, where adversarial instructions are planted in the environment such as web pages. In this paper, we introduce multi-step indirect prompt injection, a new attack class against CUAs in which the adversarial goal is decomposed into multiple innocuous-looking sub-steps and distributed across a chain of pages referenced along the agent's navigation path. We develop a pipeline to automatically decompose an adversarial goal under the constraint that the execution of the decomposed sub-steps must achieve the original goal while optimizing the innocuousness of each decomposed sub-step. With this pipeline, we build StepJack, a CUA safety benchmark with 480 test examples. On this benchmark, we evaluate six state-of-the-art CUAs and find that at a fixed decomposition depth, multi-step attacks raise attack success rate (ASR) on three of six CUAs, by up to 31.2 points (e.g., GPT-5.4-mini: 41.7% at single-step to 72.9% at three-step); averaged over the five CUAs that can reliably follow the reference chain (all but EvoCUA-32B), ASR rises from 31.3% at single-step to 36.9% at three-step. Dataset and code are available at https://github.com/BorealisAI/StepJack.

Problem

• indirect prompt injection
• computer-use agents
• multi-step attacks
• agent safety
• adversarial decomposition

Innovation

• multi-step indirect prompt injection
• computer-use agents
• adversarial decomposition
• agent safety benchmark
• StepJack