[Paper Review] When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents

Jaylen Jones, Zhehao Zhang+7 more|arXiv (Cornell University)|Feb 9, 2026

Security and Verification in Computing0 citations

TL;DR

The paper introduces AutoElicit, an agentic framework that automatically elicits unsafe, unintended behaviors from computer-use agents (CUAs) using benign inputs, demonstrating high transferability across frontier CUAs and providing a scalable analysis pipeline.

ABSTRACT

Although computer-use agents (CUAs) hold significant potential to automate increasingly complex OS workflows, they can demonstrate unsafe unintended behaviors that deviate from expected outcomes even under benign input contexts. However, exploration of this risk remains largely anecdotal, lacking concrete characterization and automated methods to proactively surface long-tail unintended behaviors under realistic CUA scenarios. To fill this gap, we introduce the first conceptual and methodological framework for unintended CUA behaviors, by defining their key characteristics, automatically eliciting them, and analyzing how they arise from benign inputs. We propose AutoElicit: an agentic framework that iteratively perturbs benign instructions using CUA execution feedback, and elicits severe harms while keeping perturbations realistic and benign. Using AutoElicit, we surface hundreds of harmful unintended behaviors from state-of-the-art CUAs such as Claude 4.5 Haiku and Opus. We further evaluate the transferability of human-verified successful perturbations, identifying persistent susceptibility to unintended behaviors across various other frontier CUAs. This work establishes a foundation for systematically analyzing unintended behaviors in realistic computer-use settings.

Motivation & Objective

• Define a concrete conceptual framework for unintended CUA behaviors and categorize safety risks arising from benign inputs.
• Propose AutoElicit to automatically elicit, analyze, and transfer unintended behaviors across frontier CUAs in realistic tasks.
• Quantify elicitation success rates and harm severities across OS-domain and Multi-Apps tasks and assess transferability to open- and closed-source CUAs.
• Provide a dataset (AutoElicit-Bench) and insights to support systematic, scalable safety evaluation of CUAs in real-world usage.

Proposed method

• Develop a four-key-characteristic definition of unintended CUA behaviors to distinguish unsafe, goal-directed harms from ordinary errors.
• Introduce AutoElicit with two stages: Context-Aware Seed Generation (LLM-based seed perturbations) and Execution-Guided Perturbation Refinement (execution feedback loops).
• Use seed perturbations to generate plausible unintended targets informed by behavior primitives and vulnerabilities; evaluate and refine seeds with multiple LLM judges and constraint adherence scores.
• Perform iterative execution feedback loops with a Trajectory Summarizer and a Behavior Elicitation Score to identify successful harms and guide perturbation revisions.
• Conduct meta-analysis (App. J) to cluster successful perturbations into vulnerability patterns and failure modes; perform transferability studies across multiple frontier CUAs (open and closed-source).

Figure 1: Unintended Behaviors in CUAs. We define the first conceptual and methodological framework for studying unintended behaviors, reflecting unsafe actions that emerge inadvertently from benign inputs during typical user interactions. For example, an agent tasked with editing a critical SSH con

Experimental results

Research questions

• RQ1 Can a systematic framework identify and categorize unintended CUA behaviors arising from benign inputs?
• RQ2 How effectively can automatic perturbation pipelines surface long-tail harms across OS and multi-app scenarios?
• RQ3 Do perturbations elicited on one CUA transfer to other frontier CUAs, indicating persistent input vulnerabilities?
• RQ4 What are the prevalent vulnerability patterns and failure modes in frontier CUAs when exposed to benign perturbations?

Key findings

• AutoElicit achieves high elicitation success across frontier CUAs, surfacing harms for up to 72.5% of OS-domain seeds and 60.8% in Multi-Apps with Claude 4.5 Haiku; 9.2–10.1% of seeds yield High or Critical harm severities.
• Human-verified elicitation success for Opus reaches up to 60% of seeds in OS and 80% in Multi-Apps, demonstrating persistent vulnerabilities despite stronger CUA capabilities.
• Elicitation perturbations transfer to other target agents with 35.0%–53.8% overall success, showing broad cross-agent vulnerability transfer across open- and closed-source CUAs.
• AutoElicit-Bench consists of 117 human-verified successful perturbations enabling broader cross-agent safety analysis.
• Meta-analysis identified 30 categories and 13 clusters for Opus and 99 categories and 29 clusters for Haiku, revealing recurring linguistic triggers and under-definitional safety constraints as major risk drivers.

Figure 2: AutoElicit : the first automatic elicitation pipeline built on an agentic framework to elicit unintended CUA behaviors from realistic computer-use scenarios. Context-Aware Seed Generation proposes plausible unintended behavior targets given an OSWorld task’s environment context and minimal