提出多步间接提示注入攻击，测试计算机使用智能体安全边界。
StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection
- 将恶意目标拆解为多个无害子步骤，分发到导航链路页面中
- 在480个测试用例上，攻击成功率最高提升31.2个百分点
- 适合研究智能体安全、对抗攻击的开发者和研究人员
计算机使用智能体（CUAs）面临间接提示注入威胁，攻击者可将恶意指令嵌入网页环境。本文提出多步间接提示注入攻击，将恶意目标分解为多个看似无害的子步骤，并分布于智能体导航路径中的多个页面。我们设计自动化流水线，在保证子步骤组合达成原目标的前提下，优化各子步骤的隐蔽性。基于此构建了包含480个测试用例的StepJack基准。评估六种先进CUA发现：在固定分解深度下，三款智能体攻击成功率（ASR）显著上升，最高达31.2个百分点（如GPT-5.4-mini：单步41.7% → 三步72.9%）；对五款能稳定跟随参考链的智能体平均ASR从31.3%升至36.9%。数据集与代码已开源。
原文摘要 · Abstract (English)
Computer-use agents (CUAs) face a growing threat from indirect prompt injection, where adversarial instructions are planted in the environment such as web pages. In this paper, we introduce multi-step indirect prompt injection, a new attack class against CUAs in which the adversarial goal is decomposed into multiple innocuous-looking sub-steps and distributed across a chain of pages referenced along the agent's navigation path. We develop a pipeline to automatically decompose an adversarial goal under the constraint that the execution of the decomposed sub-steps must achieve the original goal while optimizing the innocuousness of each decomposed sub-step. With this pipeline, we build StepJack, a CUA safety benchmark with 480 test examples. On this benchmark, we evaluate six state-of-the-art CUAs and find that at a fixed decomposition depth, multi-step attacks raise attack success rate (ASR) on three of six CUAs, by up to 31.2 points (e.g., GPT-5.4-mini: 41.7% at single-step to 72.9% at three-step); averaged over the five CUAs that can reliably follow the reference chain (all but EvoCUA-32B), ASR rises from 31.3% at single-step to 36.9% at three-step. Dataset and code are available at https://github.com/BorealisAI/StepJack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。