{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.03089",
  "title": "Securing Computer-Use Agents Against Branch Steering Attacks",
  "summary": "COBRA replaces the vanilla Dual-LLM pattern for computer-use agents, in which the Planner's data-dependent branches can be steered by adversarial page content, with trusted branching plans whose parameters and destinations are constrained ahead of time per branch. It costs additional planner-side engineering: developers must enumerate anticipated branches and pre-bind the capabilities, arguments, and destinations each branch may invoke, adding design complexity and potentially blocking unanticipated legitimate paths. It can fail when benign tasks fall outside the pre-enumerated branch set (the paper reports 97% utility, implying some loss), and its guarantees depend on the correctness of the capability constraints rather than on model robustness.",
  "rationale": "The defense is specific to production computer-use agents with a Dual-LLM architecture, which this reader is unlikely to be deploying today; it is worth tracking if they later ship GUI-interacting agents, but it is not an adoptable drop-in for typical LLM workloads.",
  "technique": "Trusted branching plans with ahead-of-time capability constraints (COBRA)",
  "family": "seguranca_e_guardrails",
  "recommendation": "observar",
  "published": "2026-10-02",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.03089",
  "independent_implementations": 1,
  "total_implementations": 2,
  "stars": 11,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "COBRA replaces the vanilla Dual-LLM pattern for computer-use agents, in which the Planner's data-dependent branches can be steered by adversarial page content, with trusted branching plans whose parameters and destinations are constrained ahead of time per branch. It costs additional planner-side engineering: developers must enumerate anticipated branches and pre-bind the capabilities, arguments, and destinations each branch may invoke, adding design complexity and potentially blocking unanticipated legitimate paths. It can fail when benign tasks fall outside the pre-enumerated branch set (the paper reports 97% utility, implying some loss), and its guarantees depend on the correctness of the capability constraints rather than on model robustness.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.03089",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "On STEER-Bench, COBRA reduces branch-steering attack success from 94.4% (standard CUA) and 89.5% (vanilla Dual-LLM) to 0% while retaining 97% benign utility.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.03089",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}