Detailed Notes on “Camels Can Use Computers Too: System-Level Security for Computer Use Agents”
What This Paper Is About
This paper tackles a big problem in AI safety. Computer Use Agents or CUAs are AI systems that can look at your computer screen and do things like click buttons, type text, and navigate websites, just like a human assistant would. The problem is that these agents are easily tricked. If a malicious website shows them a fake popup saying “click here to accept cookies” when really it leads to a dangerous site, the agent can be hijacked. Bad actors can embed hidden instructions in webpage content that make the agent do things the user never wanted, like sending private data to an attacker. Previous attempts to fix this relied on pattern recognition, essentially teaching the agent to spot attacks, but this approach is fragile and known to fail against novel attacks. The paper proposes a fundamentally different approach based on architectural isolation, meaning the system is structurally designed so that the planner part of the agent never sees untrusted content at all.
The Dual-LLM Architecture
The core idea is to split the agent into two separate parts that cannot interfere with each other. The first part is the Privileged Planner or P-LLM, which is a secure language model that creates the entire execution plan upfront before it ever sees anything on the screen. It is blind to the environment, so no amount of malicious content on a webpage can influence its planning. The second part is the Quarantined Perception model or Q-VLM, which is a vision language model that actually looks at the screen and interacts with the environment. The key insight is that the Q-VLM can only execute actions that the P-LLM has already written into the plan, so even if the Q-VLM is tricked, it can only follow pre-approved paths. This separation guarantees what the paper calls Control Flow Integrity or CFI, meaning the structure of which actions run and in what order is fixed by the planner and cannot be changed by anything the agent sees on screen. Previous work had shown this approach works well for text based agents with simple tool APIs, but applying it to agents that need to see and click on computer screens was thought to be fundamentally impossible.
The NOVA Methodology
The researchers realized that while computer screens are dynamic and ever changing, the workflows a user needs are actually structurally predictable. When you tell an agent to find the weather forecast, certain patterns repeat almost every time. You need to check if the browser is open. If not, open it. Check if the right website is loaded. If not, navigate to it. Handle any cookie popups that appear. Find the search bar. Type in the query. Read the results. These patterns can be anticipated and encoded in advance. The researchers developed a methodology called NOVA, which stands for Navigating via Observation, Verification, and Action. Every step in the plan follows this three part pattern. First, Observe means the plan calls the Q-VLM to gather information about the current screen, like summarizing what is visible or finding specific elements. Second, Verify means the plan calls a special function called verify_hypothesis that uses a separate language model under a strict fixed prompt to check whether a predicted condition matches the observation. For example, the plan might predict “we are on a weather website” and the verification checks whether that is true. This returns a simple yes or no answer. Third, Act means the plan executes actions like clicking or typing, but only after the verification has confirmed the right state. This structure allows the planner to reason in advance about all the possible states the computer could be in and create branches and fallbacks for each one, even though it never sees the screen itself.
Why CUA Plans Are More Complex Than Text Agent Plans
The paper provides a detailed comparison showing just how much more complex Computer Use Agent plans are compared to text based agent plans. For text based benchmarks like AgentDojo, plans averaged about 5 tool calls and 52 lines of code. For Computer Use Agents using the NOVA methodology, plans averaged 41 tool calls and 213 lines of code. The number of conditional branches grew from about 4 to about 40. This is because the planner cannot see the screen and must anticipate every possible state the computer could be in. The agent might start with the browser already open on the right page, or the browser might not be open at all, or it might be open on a completely wrong page. There might be a cookie popup blocking the view. The find function might fail and need retrying with different phrasing. Every one of these possibilities needs a separate branch in the plan. The paper shows that roughly half of all plan nodes are fallback paths that do not execute on any given run but exist purely as contingency for unexpected states.
How Well Does It Actually Work
The researchers tested their system on OSWorld, a standard benchmark for Computer Use Agents that involves tasks across applications like Chrome, LibreOffice, GIMP, VS Code, and others. They tested three different CUA backends, including two small open source models called UITars and OpenCUA, and one large closed source model called Claude Sonnet 4.5. The results show that the approach retains significant utility. For smaller open source models, performance actually improved by up to 19 percent compared to running them unprotected, because the structured planning methodology compensates for their weaker reactive capabilities. For larger closed source models, the system retains up to 57 percent of the unprotected performance at pass@5. The researchers also found that the quality of the planner model is what matters most. When they tested 9 different planner models on a subset of tasks, the three best planners achieved very similar results despite using very different CUA backends. This suggests that as language models get better at reasoning, the security benefits of this architecture will only increase without any fundamental changes needed. They also discovered that performance scales well with more planning attempts. At pass@20, Claude performance reached almost 73 percent, showing that the approach continues to improve with more parallel sampling.
What Attacks Still Work: Branch Steering
The Dual-LLM architecture successfully prevents the most dangerous class of attacks where the attacker injects new instructions that force the agent to do something outside its plan. However, the paper identifies a new and subtler attack class called Branch Steering that the architecture does not fully prevent. In Branch Steering, the attacker does not try to inject new actions. Instead, they manipulate the visual environment to trick the Q-VLM into returning false information that routes execution down a dangerous but structurally valid path within the existing plan. For example, an attacker could embed a fake cookie popup inside an advertisement banner. When the plan calls the find function to locate a cookie popup, the Q-VLM returns the coordinates of the fake popup instead of a real one. The agent then clicks on the ad and gets redirected to an attacker controlled website. The plan itself has not been violated. The agent was always supposed to handle cookie popups. But the data flowing through the plan has been manipulated. The paper develops two specific Branch Steering attacks. The Cookie Popup Attack embeds fabricated cookie popups in ad banners, with multi-step variants that route through intermediate sites to bypass hyperlink verification and long-range variants that place the fake popup on a later page the attacker predicts the agent will visit. The Pixel Attack uses gradient based optimization to add subtle pixel perturbations to an ad banner, so tiny that a human would not notice them, that make the Q-VLM return plausible but false information about what it sees, including fake thought traces that justify clicking on the wrong element. This attack is so effective that even the strongest redundancy defenses fail to catch it.
The Defenses They Tried
The researchers tested two redundancy based defenses against Branch Steering attacks. DOM Consistency uses an independent vision language model to cross check the Q-VLM’s visual findings against the actual Document Object Model or DOM of the webpage. If the Q-VLM says it found a cookie popup but the DOM shows an advertisement frame, the action is blocked. This works well against simple static ad banners where the DOM clearly marks the advertisement section. However, HTML5 ad banners allow the attacker to rewrite the DOM itself, replacing the advertisement frame with what looks like a legitimate cookie frame, so the DOM check passes. Multi-Modal Consensus uses a second independent vision language model, typically from a different vendor, to check the Q-VLM’s output against both the screenshot and the original instruction. This defense struggles to distinguish fabricated content from legitimate content without also flagging benign interactions, leading to either high false positive rates that break the user experience or low detection rates that miss attacks. The pixel attack specifically optimizes the perturbation to produce Q-VLM outputs that appear consistent across all checks, so both the screenshot and the DOM and the Q-VLM output all look legitimate.
What This Means for Privacy and Cost
The Dual-LLM split has an interesting side benefit for privacy. Because the planning model never sees the environment, a proprietary model like GPT or Claude can handle the planning without ever seeing sensitive user data from the screen. Meanwhile, an open source model running locally can handle the perception, which reduces cost and keeps private information on the user’s machine. The paper also analyzes token costs and finds that CaMeL-NOVA adds only about 1.88 times the tokens compared to an undefended agent. In contrast, the alternative Fides approach adds 29.6 times the tokens because it re-invokes the planner with full history at every step instead of generating the plan once. Adding Multi-Modal Consensus defenses on top of CaMeL-NOVA raises total tokens to about 6.57 times, which is significant but still manageable compared to the alternatives.
The Broader Lesson
The paper challenges an assumption that many researchers held, which is that Computer Use Agents fundamentally need continuous visual feedback to work and therefore cannot be secured through architectural isolation. The evidence shows that computer use tasks are often less data dependent than they appear. Many steps in a workflow, like opening a browser, handling cookie popups, or finding a search bar, are generic routines that can be anticipated and encoded in advance. The planner does not need to see the screen to know that these steps will be necessary. It only needs to verify which state the computer is actually in at each step. This finding suggests that the current academic benchmarks may rely less on real time reactivity than previously thought, and that with careful planning, advanced reasoning capabilities are sufficient to navigate complex application specific tasks.
What The Research Was Trying To Make Possible
The research was trying to make it possible to build Computer Use Agents that are provably secure against instruction injection attacks without sacrificing too much of their practical usefulness. Prior to this work, the prevailing view was that you had to choose between security and utility. You could either lock the agent down so tightly that it could not be hijacked, but then it would also be too rigid to do useful work, or you could let it observe the screen freely and be useful, but then it would remain vulnerable to any malicious content it encountered. This paper shows that this tradeoff is not as strict as people thought and that a middle ground exists where the agent can still accomplish most tasks while being architecturally protected from the most dangerous class of attacks.
What Assumption It Quietly Depends On
The paper depends on the assumption that the planner can predict the branching structure of the task accurately enough at plan time. This assumption works well for tasks that follow predictable patterns, like web browsing or form filling, but it may break down for truly open ended tasks where the sequence of actions depends on unexpected intermediate results. For example, if a task requires the agent to explore an unfamiliar application or debug an unknown error, the planner cannot anticipate all the states it might encounter. The paper acknowledges this as task data dependency being the main limitation factor. The approach also assumes that the attacker cannot compromise the planner model itself. If the planner model is compromised, all security guarantees collapse because the attacker controls the plan. And it assumes that the verify_hypothesis function with its fixed comparison prompt cannot itself be manipulated, which may not hold as language models become more capable and adversarial techniques become more sophisticated.
What Becomes Obvious After Reading That Was Not Obvious Before
It becomes obvious that the structure of computer use tasks is much more predictable than it seems. Watching an AI agent browse the web feels fluid and reactive, like it is constantly adapting to what it sees. But underneath, the sequence of steps is highly stereotyped. Open browser, check if on the right page, handle cookie popup, find search bar, type query, read results, extract information. This predictability means that a planner that never sees the screen can still produce useful plans because it knows the generic structure of the task. The paper makes it clear that the perceived need for continuous visual feedback is partly an artifact of how current agents are trained, which is to react to whatever they see in a multi turn loop, rather than a fundamental requirement of the task itself.
Where The Idea Breaks If You Push It Outside The Paper
If you push this idea outside the paper, it breaks in several interesting places. First, it breaks for tasks where the next step genuinely depends on specific visual information that cannot be anticipated. For example, asking an agent to “find any error messages on the screen and fix them” requires the agent to see what the error actually says before deciding what to do. The planner cannot branch for every possible error message. Second, it breaks for tasks that require creative exploration, like “find me a good recipe for dinner tonight.” The agent needs to browse, evaluate options based on visual quality, and make subjective judgments that cannot be pre planned. Third, the approach becomes increasingly brittle as task complexity grows because the number of branches the planner must write grows combinatorially. For a task with 10 decision points each having 3 possible states, the plan would need to handle 3 to the power of 10 or about 59,000 potential paths. The paper’s examples show this problem already appearing with tasks like browsing a natural products database on drugs.com, where the depth of navigation steps was not clear in advance. Fourth, the Branch Steering vulnerability shows that even with perfect control flow security, the system can still be manipulated if the perception model can be tricked. As language models become more capable, this vulnerability may grow worse, not better, because more capable models can be more easily manipulated in subtle ways that are harder to detect.
What Long Running Problem This Paper Moved
This paper moved the problem of securing AI agents from a purely reactive defense paradigm to a proactive architectural one. Prior work focused on detecting attacks after they happen, using pattern recognition, monitoring, and rules that can always be bypassed. This paper shows that the problem can be addressed at the system architecture level, by structurally separating concerns so that the planner is never exposed to untrusted data. This is a fundamentally stronger approach because it does not depend on recognizing attack patterns. It makes entire classes of attacks structurally impossible rather than merely detectable. The paper also moved the problem of understanding task structure by showing that seemingly dynamic environments have predictable workflows that can be identified and encoded, which opens up new possibilities for secure automation that were previously thought infeasible.
Chasing Questions
What was the research trying to make possible?
The research was trying to make it possible for Computer Use Agents, which are AI systems that automate tasks by looking at screens and clicking around, to be secure against prompt injection attacks while remaining practically useful. Before this work, people thought you had to choose between having a secure but useless agent or a useful but insecure one. The researchers wanted to prove that architectural isolation, where the planner never sees untrusted content, could work even for the visually dynamic and unpredictable world of computer screens. They wanted to show that the structure of computer use tasks is predictable enough that a blind planner can still produce working plans by anticipating possible states in advance.
What assumption does it quietly depend on?
The approach quietly depends on the assumption that the planner can predict the branching structure of the task accurately enough at plan time. It assumes that most computer use tasks follow predictable patterns where the possible states the computer could be in at each step are enumerable in advance. This is true for common tasks like web browsing, form filling, and document editing, but it may not hold for truly open ended tasks, creative exploration, debugging, or any scenario where the next step depends on specific unexpected visual content. The approach also assumes that the perception model, even though it is quarantined, can be trusted to provide accurate information on demand. If the perception model is compromised through Branch Steering or other data flow attacks, the control flow guarantees alone are not enough to prevent harm.
What becomes obvious after reading it that was not obvious before?
It becomes obvious that computer use tasks are much more predictable than they appear. Watching an AI agent interact with a computer looks like continuous real time adaptation, but the underlying structure is highly stereotyped. Opening a browser, handling cookie popups, finding search bars, navigating menus, and extracting information all follow repeatable patterns that can be anticipated and encoded. This means the perceived need for continuous visual feedback is partly an artifact of how current agents are trained rather than a fundamental requirement of the task. Once you see the workflow broken down into its predictable components, it becomes obvious that single shot planning with verification checkpoints is a natural fit for most computer use tasks.
Where does the idea break if you push it outside the paper?
The idea breaks when tasks require genuine visual discovery that cannot be anticipated, like finding and fixing an unknown error message or browsing a website to pick the best looking option. It breaks for tasks with deep navigation where the number of potential states explodes combinatorially, making it impossible for the planner to enumerate all branches. It breaks when the task description is underspecified and the agent needs to explore to figure out what to do. And it breaks against Branch Steering attacks where the perception model is tricked into following dangerous paths within the legitimate plan. As language models become more capable, the perception vulnerabilities may actually become harder to defend against, not easier, because the attacks can be more subtle and harder to detect.
What long running problem did this paper move, even slightly?
This paper moved the problem of AI agent security from a reactive detection based paradigm to a proactive architectural one. Prior work tried to recognize attacks after they occurred through pattern recognition, monitoring, and rules. This approach is inherently fragile because attackers can always find novel ways around the detection. This paper showed that architectural isolation, specifically the Dual-LLM pattern, can be adapted to Computer Use Agents, making entire attack classes structurally impossible rather than merely detectable. This shifts the conversation from how to spot attacks to how to design systems that cannot fall for them in the first place. The paper also moved the problem of understanding task structure by demonstrating that seemingly dynamic visual environments have predictable workflows, which opens up new possibilities for secure automation across many domains.