StepJack: Multi-Step Indirect Prompt Injection Against Computer-Use Agents
First seen Aug 10, 2026 · Updated Aug 10, 2026
This is an academic research paper introducing StepJack, a benchmark that demonstrates how indirect prompt injection attacks against computer-use agents (CUAs) become significantly more effective when the adversarial goal is split across multiple innocuous-looking sub-steps distributed across a chain of web pages. It is not an active exploit, but the findings show meaningfully higher attack success rates against several state-of-the-art CUAs compared to single-step injection, indicating a real and underexplored gap in current agent safety defenses. Severity is rated medium because this is disclosed research with a public benchmark rather than an in-the-wild attack, but the technique is practically reproducible.
Technical Analysis
The attack plants adversarial instructions across a chain of web pages that a computer-use agent navigates, decomposing a single malicious goal into several sub-steps that each appear benign in isolation, evading per-page content filters or intent classifiers that scan individual pages for obviously malicious instructions. The entry point is the agent's environment perception (rendered web page content, DOM/text scraped during browsing) which is indirect and untrusted input the agent's planner treats as part of its task context. By distributing intent across the navigation path, the attacker crosses the boundary between 'passive environment content' and 'agent action authority,' effectively hijacking the planner's goal state incrementally without triggering single-shot injection detectors. The paper shows ASR increases substantially (e.g., up to 31.2 points for one tested CUA) as decomposition depth increases, demonstrating that current CUA safety mechanisms largely evaluate injection risk per-step rather than tracking cumulative intent across a session.
Affected Systems
EvoCUA-32B, GPT-5.4-mini (as evaluated CUA), and other unnamed state-of-the-art computer-use agents referenced in the benchmark
Detection Signatures
- Sequential low-signal instructions embedded across multiple pages/DOM elements along a agent's navigation path that individually appear harmless but reference or build on each other
- Sudden shifts in agent task/goal state after visiting a chain of referenced pages not part of the original user instruction
- Repeated navigation to attacker-controlled or unexpected pages via in-page links/references during otherwise unrelated tasks
- Anomalously high multi-page click/navigation chains preceding a sensitive action (form submission, credential entry, file download/execution)
Remediation Steps
- 1
Track cumulative intent across navigation sessions
Implement session-level intent tracking that evaluates the aggregate goal drift across all pages visited in a task, not just per-page injection scanning.
- 2
Constrain agent goal mutability
Require explicit user/operator confirmation before an agent's original task goal is expanded or modified by content encountered during execution.
- 3
Sanitize and isolate untrusted page content
Treat all in-page text/instructions as untrusted data rather than actionable instructions; use strict instruction-vs-content separation in the agent's context construction.
- 4
Limit high-risk actions after multi-hop navigation
Apply additional scrutiny or human-in-the-loop gating for sensitive actions (payments, credential use, downloads) that occur after traversing multiple referenced pages.
- 5
Adopt benchmark-driven red-teaming
Use StepJack and similar benchmarks to regularly evaluate CUA robustness against decomposed/multi-step injection before deployment.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.