Multi-turn attacks erode GUI agent safety guardrails

Three frontier GUI agents gave back half a safety guardrail's protection once testers stretched a scripted attack to four turns, per arXiv 2607.29199.

That matters for anyone benchmarking an agent's screen-clicking safety. A single guardrail line cut attack success by roughly 40 points in a single-turn test. Four-turn escalation clawed back about 20 of those points before the test ended.

The setup excluded environment injection entirely. Testers relied only on screen-grounded, user-side persuasion. The pressure came from what looked like a normal user typing follow-up requests, not from tampered web content or hidden instructions.

The erosion split by model. Qwen's guarded attack success rate degraded substantially across the four-turn chains. Claude and GPT showed a different failure mode, described in the paper as more orthogonal risk rather than the same guardrail simply wearing down.

A guardrail number measured in one turn isn't the number that matters once a user can keep asking. Qwen is the model to watch first if this erosion pattern holds outside the paper's three test agents.

As of August 3, this is the clearest published test of GUI agent guardrails against persuasion alone, with no environment injection muddying the result.