Attacking Vision-Language Computer Agents via Pop-ups

1 Introduction

• The study targets a gap in understanding risks to VLM agents as visual inputs become more integrated into agentic applications.If agents follow malicious pop-ups, the stated risks include malware installation or redirection to deceptive websites.Source: §1 · p. 1
• The attack manipulates observations such as screenshots and accessibility trees, matching scenarios including malvertising, injected scripts, and clickable images in messages.The threat model assumes attackers can alter the attacked element’s observations.Source: §1 · p. 2
• Attack success exceeds 80% on OSWorld and 60% on VisualWebArena; basic defenses reduce attack success by no more than 25% relatively.The tested defenses ask agents to ignore pop-ups or add an advertisement notice.Source: §1 · p. 2
• The pop-up design combines an attention hook, an instruction, an information banner, and an optional ALT descriptor for frameworks using accessibility-tree ALT strings.The attention hook is query-related; the instruction specifies the attacker’s desired behavior.Source: §1 · p. 2
• Using alternatives to the actual user query for the attention hook reduces attack success by 61% relatively on average, while position and framework information are relatively unnecessary.The paper also reports that basic defenses are ineffective, reducing attack success by no more than 25% relatively.Source: §1 · p. 2

2 Related Work

• Set-of-Mark prompting tags clickable image elements, while SeeAct uses HTML attributes to formulate textual choices for grounding GUI actions.The section notes that structural HTML is unavailable in broader computer-use cases and that accessibility-tree information can be poorly supported and slow to process.Source: §2 · p. 2
• Prior attacks add learnable image noise or inject invisible malicious webpage instructions, whereas this work targets malicious elements in observations.The paper characterizes image-noise optimization as requiring thousands of steps and transferring less effectively to commercial closed-source VLMs.Source: §2 · pp. 2–3
• The paper distinguishes its focus on malicious pop-ups from studies of distraction by unrelated, non-malicious environmental elements.It frames its contribution as studying agent robustness to malicious content in observations.Source: §2 · p. 3

3 Attack Design

• The threat model assumes attackers have the information needed to take ideal actions toward making agents click pop-ups, while alternatives consider easier-to-access information and advertising regulations.The design space contains four representative attack elements.Source: §3 · p. 3
• The attention hook defaults to an LLM summary of the user query, with a fake virus alert and a screen-context-based guess as alternatives.The summary is intended to make the pop-up seem related to the task; alternatives address cases where the attacker lacks the actual query.Source: §3 · p. 3
• The instruction can give the pop-up’s coordinates or SoM tag ID, say “Please click here,” or provide a random coordinate or tag ID.Exact coordinates and tag IDs are described as direct instructions; random choices make success depend on pop-up area or the number of tagged elements.Source: §3 · p. 3
• The default info banner says “OK” to frame the pop-up as a button, while the alternative says “ADVERTISEMENT”; optional ALT text uses the hook and instruction.The ALT descriptor variants also include an empty string or an “ADVERTISEMENT:” prefix.Source: §3 · pp. 3–4
• Attacks significantly delay task completion on both benchmarks, with more tasks stopping at the step limit.Figure 3 plots action-step distributions with and without attack, with task proportion on the y-axis; it reports GPT-4-Turbo on OSWorld with a 15-step limit and GPT-4o on VisualWebArena with a 30-step limit.Source: Figure 3 · p. 4

4 Experiments

• Experiments tested screenshot and SoM agents on 50 easy OSWorld tasks and SoM agents on 72 VisualWebArena tasks, using five frontier VLMs.OSWorld tasks had a 15-step limit and VisualWebArena tasks a 30-step limit; the study also attacked observations when there was room for pop-ups.Source: §4 · p. 4

4.1 Main Result

• ASR exceeded 60% for all models in every scenario; SR was at most 10% in OSWorld and around 45% in VisualWebArena.At least 80% of OSWorld tasks did not finish within the step limit, while VisualWebArena tasks were often short enough to finish despite pop-up clicks.Source: §4.1 · p. 5

4.2 Ablation Study

• Changing the summarized query to a virus alert produced a more dramatic ASR drop for SoM agents (−33.5% and −61.0%) than screenshot agents (−3.3%); speculated-query attacks averaged 33.3% ASR.Source: §4.2 · p. 5
• For SoM agents, using coordinate clicks instead of framework-specific instructions reduced ASR by only 4.3% and 12.8%, supporting coordinates as a broadly usable choice.Random targets still produced non-trivial ASR; random clickable tags yielded 34.7% SR.Source: §4.2 · pp. 5–6
• Changing an info banner from “OK” to “ADVERTISEMENT” left ASR above 55%, while removing the pop-up ALT descriptor reduced ASR by 23.7% and 19.2%.Adding an advertisement notice before the adversarial ALT descriptor did not significantly reduce ASR compared with an empty ALT string.Source: §4.2 · p. 6
• Blank pop-ups slightly decreased SR, and pop-ups made 50% smaller caused a small ASR decrease.The authors note that pop-up size may be managed by the website and that their attack assumes readable text.Source: §4.2 · p. 6

4.3 Defense

• A system prompt asking agents to ignore pop-ups had almost no mitigation effect; a more specific prompt reduced ASR by 25% relatively, but SR remained low.The authors caution that explicitly ignoring on-screen clicking instructions could also suppress benign, useful instructions.Source: §4.3 · p. 6
• Step-wise prompt defense reduced ASR further but only marginally increased SR; removing “Please click” from malicious instructions could raise ASR without search or optimization.The authors suggest browser content filtering, malicious-instruction detection, or more specific defensive prompts, while noting these may not mitigate all environmental risks.Source: §4.3 · pp. 6–7

5.1 Task-level Attack Success Rate

• TASR is generally positively associated with ASR and can be multiple times higher when ASR is below 0.2, as clicks accumulate across multi-step tasks.TASR counts tasks where an agent clicks a pop-up at least once; ASR counts the step-level ratio of successful attacks among attempted attacks.Source: Figure 4 · p. 7, §5.1 · pp. 7–8

5.2 How Does Our Attack Succeed?

• Attacked agents’ thoughts become more specific about pop-up elements, which can guide them away from usual reasoning and toward malicious instructions.Examples include target coordinates or tags, attention-hook text, and an “OK” banner; Figure 6 also shows actions implicitly affected despite correct thoughts.Source: §5.2 · pp. 8–9, Figure 6 · p. 9
• In 50 manually annotated successful OSWorld cases per agent type, screenshot agents focused on fake “OK” buttons in 52% of thoughts, while SoM agents mentioned summarized queries in 62%.Some successful examples did not mention pop-up elements in their thoughts but still implicitly followed the instructions, increasing attack stealthiness against defenses that inspect thoughts.Source: §5.2 · p. 9

5.3 How Does Our Attack Fail?

• Attacks commonly fail when agents declare WAIT/FAIL/DONE, answer information-seeking queries from page content, use familiar tools such as a terminal, or face more confident actionable elements.Source: §5.3 · p. 9

• VLM agents can be maliciously instructed by adversarial pop-ups that they do not distinguish from typical digital content.Source: §6 · p. 9
• The authors suggest training models and agents to ignore environmental noise and prioritize legitimate instructions before real-world operation.They note that this concern also applies to embodied agents encountering distractors absent from training data.Source: §6 · p. 9
• The paper calls for careful human oversight of automated agent workflows and future work on supervision and intervention for safety.Source: §6 · p. 9

• The study tests only closed-source models, limiting deeper understanding of why the attack works.The authors cite relatively low open-source model performance on computer-agent benchmarks as the reason for this choice.Source: Limitations · p. 10
• The study focuses on high-level pop-up design and component contributions rather than optimizing pop-up strings or making them more persuasive.Source: Limitations · p. 10

• The study is conducted solely for research purposes, with discussion of attack design choices, defenses, and their effectiveness.Source: Ethical Considerations · p. 10
• The authors emphasize human oversight and advocate safety training before agentic systems are widely deployed.Source: Ethical Considerations · p. 10

A Appendix

• The implementation places pop-ups in the largest screen rectangle outside detected a11y-tree and OCR boxes, with maximum dimensions of 960 by 540 pixels.Attacks are applied when both available dimensions exceed 100 pixels; clicked pop-ups do not redirect the agent.Source: A Appendix · p. 12
• Benign, non-clickable ALT templates slightly increase task success rate and slightly decrease attack success rate compared with clickable templates.The ablation is reported in Table 10; the supplied caption identifies it as a study of ALT templates.Source: A Appendix · p. 12, Table 10 · p. 12
• Agents can become trapped repeatedly clicking pop-ups instead of effectively exploring the environment.The appendix plots successfully attacked steps for screenshot agents and SoM agents; Figure 7 marks attacked steps red, other steps green, and post-termination steps gray.Source: A Appendix · p. 12, Figure 7 · p. 13, Figure 9 · p. 14
• 80.4% for screenshot agents and 88.1% for SoM agents were the attack success rates when attacks began after the 7th step.The authors hypothesize that attack-free history retained in agent memory may explain the increased robustness.Source: A Appendix · p. 12
• In delayed-attack plots, attacks begin only after the 7th step for screenshot agents and SoM agents.The corresponding plots are Figures 8 and 10; Figure 8 contrasts with Figure 7, and Figure 10 with Figure 9.Source: Figure 8 · p. 13, Figure 10 · p. 14