StepJack: splitting a prompt injection across three web pages nearly doubles the attack success rate on computer-use agents

arXiv (Borealis AI)·high signalXBlueskyLinkedInCopy link

Borealis AI researchers released StepJack (arXiv:2608.06477, submitted 2026-08-06), a 480-example benchmark that decomposes a malicious goal across multiple pages in a computer-use agent's navigation path rather than planting it in one. Across six state-of-the-art CUAs, average attack success rises from 31.3% at single-step to 36.9% at three-step, with GPT-5.4-mini jumping from 41.7% to 72.9% — a 31.2-point swing. The perverse finding: EvoCUA-32B resisted mainly because it could not reliably follow multi-step reference chains, meaning the better an agent is at multi-hop reasoning, the more exploitable it becomes. Dataset and code are public on GitHub.