A wave of research exposes new attacks on AI agents that operate computers
Five papers published within a week describe attacks that split malicious instructions across pages, hide them in agent memory, or exploit diffusion-model architectures.
- Security & misuse
- Safety & alignment
- Minor
Between 6 and 12 August 2026, five independent research groups published papers converging on a single theme: as AI agents move from answering questions to directly operating computers, browsers and external tools, they open attack surfaces that conventional single-turn jailbreak testing does not capture.
StepJack described “multi-step indirect prompt injection,” in which an attack against a computer-use agent is broken into several individually innocuous sub-steps planted across a chain of linked web pages, so no single page looks malicious; against a 480-example benchmark, the technique raised attack success rates by as much as 31 percentage points over single-step injection on several tested agents. HarnessSafe examined a related problem — that agent “harnesses” persist state across sessions through memory, saved skills and shared files, so a malicious instruction planted once can lie dormant and later trigger during an unrelated, apparently benign task; its 328-case benchmark found containment varied sharply by which combination of harness and underlying model was used. ToolHazard built a framework for automatically generating adversarial tool-use environments at scale, arguing prior work relied too heavily on hand-built test cases, and reported that training on its synthetic attacks improved agent robustness on an existing benchmark without degrading normal task performance.
Two papers targeted the evaluation methods safety teams rely on rather than agents directly. “Measuring the Wrong Thing” argued that a common internal safety-scoring technique — judging a prompt’s harmfulness before generation — systematically misranks which prompts will actually produce successful jailbreaks, finding that in one test, prompts wrapped to evade detection scored as more dangerous by an outcome measure while scoring as safer by the internal one. A fifth paper examined diffusion-based language models specifically, showing that their safety alignment is often inherited wholesale from the autoregressive models they were initialised from, making them vulnerable to transfer attacks that reached success rates above 70% on several tested systems.
No single paper claimed a fix. Taken together they mark computer-use and tool-using agents — rather than single-turn chat — as the area attracting the most active adversarial research attention in August 2026, ahead of any consensus on how such agents should be secured.