mlsanityData to 7 Oct 2026

VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents

arXiv 2506.02456 ↗First posted 3 Jun 2025cs.AI cs.CRcited by 42

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Computer-Use Agents (CUAs) with full system access enable powerful task automation but pose significant security and privacy risks due to their ability to manipulate files, access user data, and execute arbitrary commands. While prior work has focused on browser-based agents and HTML-level attacks, the vulnerabilities of CUAs remain underexplored. In this paper, we investigate Visual Prompt Injection (VPI) attacks, where malicious instructions are visually embedded within rendered user interfaces, and examine their impact on both CUAs and Browser-Use Agents (BUAs). We propose VPI-Bench, a benchmark of 306 test cases across five widely used platforms, to evaluate agent robustness under VPI threats. Each test case is a variant of a web platform, designed to be interactive, deployed in a realistic environment, and containing a visually embedded malicious prompt. Our empirical study shows that current CUAs and BUAs can be deceived at rates of up to 51% and 100%, respectively, on certain platforms. The experimental results also indicate that system prompt defenses offer only limited improvements. These findings highlight the need for robust, context-aware defenses to ensure the safe deployment of multimodal AI agents in real-world environments. The code and dataset are available at: https://github.com/cua-framework/agents

Key facts. Cited by 42 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 41 of its 57 references that are in the map. First posted on arXiv 3 Jun 2025.

Builds on

41 of 57 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025WebInject: Prompt Injection Attack to Web Agents16 May
  2. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injection19 Apr
  3. 2025Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysis27 Feb
  4. 2024Attacking Vision-Language Computer Agents via Pop-ups4 Nov
  5. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  6. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep
  7. 2024Dissecting Adversarial Robustness of Multimodal LM Agents18 Jun
  8. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents5 Jun
  9. 2024WIPI: A New Web Threat for LLM-Driven Web Agents26 Feb
  10. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents17 Feb

Other references · 31

  1. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  2. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  4. 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,210
  5. 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
  6. 2023HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Facecited by 1,173
  7. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  8. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  9. 2025UI-TARS: Pioneering Automated GUI Interaction with Native Agentscited by 584
  10. 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 547
  11. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
  12. 2023AgentTuning: Enabling Generalized Agent Abilities for LLMscited by 319
19 more
  1. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  2. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 113
  3. 2024Agent-FLAN: Designing Data and Methods of Effective Agent Tuning for Large Language Modelscited by 97
  4. 2025GuardReasoner: Towards Reasoning-based LLM Safeguardscited by 89
  5. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 73
  6. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  7. 2024Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractionscited by 55
  8. 2024Multimodal Situational Safetycited by 54
  9. 2023JailGuard: A Universal Detection Framework for LLM Prompt-based Attackscited by 46
  10. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignmentcited by 42
  11. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 38
  12. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselvescited by 34
  13. 2024KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detectioncited by 29
  14. 2025HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden Statescited by 29
  15. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectorscited by 26
  16. 2024UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Modelscited by 18
  17. 2024VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wildcited by 17
  18. 2024PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detectioncited by 16
  19. 2025Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalizationcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 5; 2026: 37.

42 papers.

Sort:

By area:

  1. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agentscited by 23
  2. 2025WAInjectBench: Benchmarking Prompt Injection Detections for Web Agentscited by 21
  3. 2026VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commitcited by 13
  4. 2026The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agentscited by 12
  5. 2025Are Your Agents Upward Deceivers?cited by 11
  6. 2026WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agentscited by 10
  7. 2025Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directednesscited by 8
  8. 2026Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agentscited by 7
  9. 2025LeechHijack: Covert Computational Resource Exploitation in Intelligent Agent Systemscited by 5
  10. 2026MirrorGuard: Toward Secure Computer-Use Agents via Simulation-to-Real Reasoning Correctioncited by 5
  11. 2026CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automationcited by 5
  12. 2026From Risk Classification to Action Plan Remediation: A Guardrail Feedback Driven Framework for LLM Agentscited by 5
30 more
  1. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
  2. 2026WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agentscited by 3
  3. 2026SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agentscited by 3
  4. 2026WARD: Adversarially Robust Defense of Web Agents Against Prompt Injectionscited by 3
  5. 2026Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden Statescited by 3
  6. 2026WebTrap Park: An Automated Platform for Systematic Security Evaluation of Web Agentscited by 2
  7. 2026Hallucination as Exploit: Evidence-Carrying Multimodal Agentscited by 2
  8. 2026StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injectioncited by 2
  9. 2026Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injectioncited by 1
  10. 2026Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolationcited by 1
  11. 2026Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teamingcited by 1
  12. 2026Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directionscited by 1
  13. 2026An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworkscited by 1
  14. 2026Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agentscited by 0
  15. 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliabilitycited by 0
  16. 2026Localize and Neutralize: Gradient-guided Token Suppression against Visual Prompt Injection Attackcited by 0
  17. 2026AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasingcited by 0
  18. 2026It Lied to a Doctor to Buy Poison Ingredients: Quantifying Real-World Misuse of Phone-use Agentscited by 0
  19. 2026Do GUI Agents Believe Their Eyes? Diagnosing State-Belief Reliance on Pixels versus Structurecited by 0
  20. 2026LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agentscited by 0
  21. 2026On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Modelscited by 0
  22. 2026COMIC: Reference-Aware Safety Gating for Multimodal Large Language Modelscited by 0
  23. 2026MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Appscited by 0
  24. 2026WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agentscited by 0
  25. 2026Repeat-After-Me: Black-Box Adaptive Visual Prompt Injectioncited by 0
  26. 2026AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agentscited by 0
  27. 2026ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agentscited by 0
  28. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  29. 2026CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agentscited by 0
  30. 2026Render Before Reading: Visual Rendering as a Prompt Injection Defensecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025A Systematization of Security Vulnerabilities in Computer Use Agents
  2. 2026Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents
  3. 2026SIR: Self-improving Red-teaming for Compute Use Agents
  4. 2025HackWorld: Evaluating Computer-Use Agents on Exploiting Web Application Vulnerabilities
  5. 2025Context manipulation attacks : Web agents are susceptible to corrupted memory
  6. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
  7. 2026Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents
  8. 2025QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents