Adaptive Indirect Prompt Injection Against Computer Use Agents (SIR Red-Teaming)
First seen Sep 1, 2026 · Updated Sep 1, 2026
This is a research paper describing SIR, a red-teaming methodology that automatically discovers and refines indirect prompt injection attacks against computer-use agents (CUAs) like Claude Opus and Gemini. It demonstrates that adaptive, self-improving attack composition significantly increases attack success rates over static hand-written injections, revealing that current CUA safety benchmarks likely underestimate real-world risk. No active exploit or in-the-wild campaign is described; this is disclosed academic security research intended to improve defenses.
Technical Analysis
SIR operates as a black-box attacker that plants indirect prompt injections in content a CUA will perceive on-screen (e.g., web pages, files, terminal output) during normal task execution, exploiting the agent's inability to distinguish trusted user instructions from untrusted environmental content. The system composes injections from a reusable library of natural-language 'principles,' then uses an iterative feedback loop that inspects failed attack trajectories to synthesize new bypass strategies, effectively automating adversarial prompt engineering against the vision-language model's instruction-following. Entry point is any untrusted content surface the CUA reads while operating at the OS level (filesystem, terminal, GUI), and success is verified deterministically via filesystem/service/permission-state oracles rather than subjective LLM judging. The attacker's gain is unauthorized OS-level actions (e.g., altered permissions, unwanted service/file changes) while the benign task appears to complete normally, and the crossing point is from passive content ingestion into privileged action execution via mouse/keyboard/terminal control. Notably, discovered attack strategies transfer across different model architectures without additional tuning, indicating a systemic rather than model-specific vulnerability in current CUA alignment/safety training.
Detection Signatures
- Unusual instructions embedded in web page text, file contents, or terminal output that attempt to redirect agent behavior (e.g., 'ignore previous instructions', role-play framing, fake system messages)
- Unexpected filesystem, permission, or service state changes following agent task completion that do not match the stated user goal
- Agent actions diverging from task plan immediately after processing external/untrusted content
- Repeated benign-task completion paired with anomalous background system modifications
- High-frequency similar injection phrasing patterns reused across different tasks or sessions (indicative of composed/templated attacks)
Remediation Steps
- 1
Sandbox and least-privilege execution
Run CUAs with minimal OS permissions, isolate terminal/filesystem access via containers or VMs, and require explicit approval for privilege-escalating or irreversible actions.
- 2
Content provenance and instruction segregation
Architecturally separate trusted user instructions from untrusted on-screen/environmental content so the model cannot conflate the two, using structured input channels and provenance tagging.
- 3
Deterministic action auditing
Implement runtime monitors that check filesystem, permission, and service state against expected task scope, flagging or blocking out-of-scope changes in real time rather than relying on post-hoc LLM judgment.
- 4
Adversarial red-teaming integration
Adopt adaptive red-teaming frameworks like SIR internally during model/agent development to continuously probe for composable injection strategies before deployment, rather than relying solely on static benchmark suites.
- 5
Cross-model strategy sharing for defense
Since attack principles transfer across architectures, share defensive mitigations and detected injection patterns across model providers/vendors to close common vulnerability classes faster.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.