计算机使用智能体（CUA）如今能够在真实的数字环境中自主完成复杂任务，但一旦被误导，它们也可能被用于以编程方式自动化执行有害行为。现有的安全评估主要针对滥用和提示注入等显性威胁，却忽略了一种微妙但关键的场景：用户指令完全善意，而危害源于任务上下文或执行结果。
我们提出了 OS-BLIND，这是一个在非预期攻击条件下评估 CUA 的基准测试，包含 300 个人工构建的任务，涵盖 12 个类别、8 个应用场景和 2 个威胁集群：环境嵌入型威胁和智能体引发型危害。我们对前沿模型和智能体框架的评估显示，大多数 CUA 的攻击成功率（ASR）超过 90%，即便是经过安全对齐的 Claude 4.5 Sonnet，其 ASR 也达到了 73.0%。
更有趣的是，当 Claude 4.5 Sonnet 部署在多智能体系统中时，这一漏洞变得更加严重，ASR 从 73.0% 上升至 92.7%。我们的分析进一步表明，当用户指令为善意时，现有的安全防御措施提供的保护十分有限。
安全对齐主要在前几步被激活，在后续执行过程中很少再次介入。在多智能体系统中，分解后的子任务掩盖了模型对有害意图的感知，导致安全对齐模型失效。我们将发布 OS-BLIND，以鼓励更广泛的研究社区进一步调查并应对这些安全挑战。
Computer-use agents (CUAs) can now autonomously complete complex tasks in real digital environments, but when misled, they can also be used to automate harmful actions programmatically. Existing safety evaluations largely target explicit threats such as misuse and prompt injection, but overlook a subtle yet critical setting where user instructions are entirely benign and harm arises from the task context or execution outcome. We introduce OS-BLIND, a benchmark that evaluates CUAs under unintended attack conditions, comprising 300 human-crafted tasks across 12 categories, 8 applications, and 2 threat clusters: environment-embedded threats and agent-initiated harms.
Our evaluation on frontier models and agentic frameworks reveals that most CUAs exceed 90% attack success rate (ASR), and even the safety-aligned Claude 4.5 Sonnet reaches 73.0% ASR. More interestingly, this vulnerability becomes even more severe, with ASR rising from 73.0% to 92.7% when Claude 4.5 Sonnet is deployed in multi-agent systems. Our analysis further shows that existing safety defenses provide limited protection when user instructions are benign. Safety alignment primarily activates within the first few steps and rarely re-engages during subsequent execution.
In multi-agent systems, decomposed subtasks obscure the harmful intent from the model, causing safety-aligned models to fail. We will release our OS-BLIND to encourage the broader research community to further investigate and address these safety challenges.