发表机构
Simon Fraser University; New York University; RBC Borealis（西蒙菲莎大学; 纽约大学; 加拿大皇家银行博雷利斯）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出多步骤间接提示注入新型攻击，构建含480个测试样例的StepJack基准，评估六款先进CUAs，发现多步骤攻击可提升部分CUAs的攻击成功率。
AI 中文摘要
计算机使用智能体（Computer-use agents, CUAs）面临日益严重的间接提示注入威胁，即敌对指令被植入网页等环境中。本文提出多步骤间接提示注入，这是一种针对CUAs的新型攻击类别，其中敌对目标被分解为多个看似无害的子步骤，并分布在智能体导航路径所引用的页面链中。我们开发了一个流水线，用于自动分解敌对目标，该流水线需满足分解后的子步骤执行后能实现原始目标，同时优化每个分解子步骤的无害性。借助该流水线，我们构建了StepJack，一个包含480个测试样例的CUA安全基准。在该基准上，我们评估了六个最先进的CUAs，发现在固定分解深度下，多步骤攻击使六个CUAs中的三个的攻击成功率（Attack Success Rate, ASR）提升了多达31.2个百分点（例如，GPT-5.4-mini：单步骤时为41.7%，三步骤时为72.9%）；在能够可靠遵循参考链的五个CUAs（除EvoCUA-32B外）上取平均，ASR从单步骤的31.3%上升至三步骤的36.9%。数据集和代码可在该https URL获取。
英文摘要
Computer-use agents (CUAs) face a growing threat from indirect prompt injection, where adversarial instructions are planted in the environment such as web pages. In this paper, we introduce multi-step indirect prompt injection, a new attack class against CUAs in which the adversarial goal is decomposed into multiple innocuous-looking sub-steps and distributed across a chain of pages referenced along the agent's navigation path. We develop a pipeline to automatically decompose an adversarial goal under the constraint that the execution of the decomposed sub-steps must achieve the original goal while optimizing the innocuousness of each decomposed sub-step. With this pipeline, we build StepJack, a CUA safety benchmark with 480 test examples. On this benchmark, we evaluate six state-of-the-art CUAs and find that at a fixed decomposition depth, multi-step attacks raise attack success rate (ASR) on three of six CUAs, by up to 31.2 points (e.g., GPT-5.4-mini: 41.7% at single-step to 72.9% at three-step); averaged over the five CUAs that can reliably follow the reference chain (all but EvoCUA-32B), ASR rises from 31.3% at single-step to 36.9% at three-step. Dataset and code are available at https://github.com/BorealisAI/StepJack.
