Abstract
Computer-use agents extend language models from text generation to persistent action over tools, files, and execution environments. Unlike chat systems, they maintain state across interactions and translate intermediate outputs into concrete actions. This creates a distinct safety challenge in that harmful behavior may emerge through sequences of individually plausible steps, including intermediate actions that appear locally acceptable but collectively lead to unauthorized actions. We present \textbf{AgentHazard}, a benchmark for evaluating harmful behavior in computer-use agents. AgentHazard contains \textbf{2,653} instances spanning diverse risk categories and attack strategies. Each instance pairs a harmful objective with a sequence of operational steps that are locally legitimate but jointly induce unsafe behavior. The benchmark evaluates whether agents can recognize and interrupt harm arising from accumulated context, repeated tool use, intermediate actions, and dependencies across steps. We evaluate AgentHazard on Claude Code, OpenClaw, and IFlow using mostly open or openly deployable models from the Qwen3, Kimi, GLM, and DeepSeek families. Our experimental results indicate that current systems remain highly vulnerable. In particular, when powered by Qwen3-Coder, Claude Code exhibits an attack success rate of \textbf{73.63\%}, suggesting that model alignment alone does not reliably guarantee the safety of autonomous agents.
Abstract (translated)
计算机使用代理将语言模型从文本生成扩展至对工具、文件和执行环境的持久化操作。与聊天系统不同，它们能在多轮交互中维持状态，并将中间输出转化为具体操作。这带来了独特的安全挑战：有害行为可能通过一系列单独看似合理的步骤逐步显现，包括局部可接受但 collectively 导致越权操作的中间行为。我们提出\textbf{AgentHazard}，一个用于评估计算机使用代理有害行为的基准测试。AgentHazard包含\textbf{2,653}个实例，涵盖多样化的风险类别和攻击策略。每个实例将有害目标与一系列操作上合法但共同引发不安全行为的步骤配对。该基准测试评估代理能否识别并中断由累积上下文、重复工具使用、中间步骤依赖等因素引发的危害。我们在Claude Code、OpenClaw和IFlow上使用Qwen3、Kimi、GLM和DeepSeek系列中多数开源或可公开部署的模型评估了AgentHazard。实验结果表明当前系统仍高度脆弱。尤其当采用Qwen3-Coder驱动时，Claude Code表现出\textbf{73.63\%}的攻击成功率，表明仅靠模型对齐无法可靠保障自主代理的安全性。
URL
https://arxiv.org/abs/2604.02947
