PaperlayerView exact revision on arXiv

Source-linked AI summary

AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions

Jingwei Sun, Jianing Zhu, Yuanyi Li, Tongliang Liu, Xia HU, Bo Han

arXiv:2605.25707v1cs.AI

TL;DR

Computer-use agents remain vulnerable to common environmental corruptions, while existing benchmarks largely overlook this robustness. AgentHijack evaluates nine configurable corruptions across desktop tasks and introduces AgentHijack-Agent, which improves performance against them, including a 4.15% gain over its basic model.

  • Problem

    Existing benchmarks overlook agents’ robustness to common dynamic-environment corruptions, despite substantial degradation during realistic computer use.

  • Method

    AgentHijack applies nine configurable corruption types to OSWorld, while AgentHijack-Agent combines an enhanced-grounding action generator with an onlooker for behavior summarization and environment checking.

  • Results

    Current agents struggle under corruptions, while AgentHijack-Agent improves overall success rate over its basic model by 4.15%.

  • Takeaways & Limitations

    The findings highlight the importance of evaluating and improving computer-use agent robustness against common corruptions.

Abstract

from arXiv · show

Autonomous computer use agents that powered by multimodal large language models (MLLMs) are emerging as capable assistants for completing complex digital workflows. However, real-world execution environments are far from ideal: pop-ups, resolution changes, and competing applications frequently interfere with agent perception and control. We introduce AgentHijack, a benchmark designed to evaluate the robustness of computer-use agents under common corruptions, where the uncertainties in dynamic environment disrupt the execution flow without direct adversarial intent. Specifically, AgentHijack introduces 9 configurable common corruptions to replicate realistic imperfect scenarios. We evaluate a variety of desktop tasks that utilize MLLM-based agents and discover that even minor instances of corruption can result in substantial performance degradation, which emphasizes the fragility of agents and underscores the necessity of robustness evaluation. Afterward, we propose AgentHijack-Agent, a framework that integrates an action generator with enhanced grounding capabilities and an onlooker responsible for behavior summarization and environment checking. Extensive experiments validate its effectiveness. Our code, environment, baseline models and data are publicly available at: https://AgentHijack.github.io.

1. Introduction

Although MLLM-based computer-use agents perform well on diverse tasks, common dynamic-environment corruptions can substantially degrade their performance. AgentHijack benchmarks this robustness with configurable corruptions, while AgentHijack-Agent combines enhanced action grounding with behavioral summarization and environment checking.

  • Motivation: MLLM-based agents have demonstrated excellent performance across office assistance, system interface operation, and professional tasks.
  • Motivation: Common corruptions such as pop-ups, accidental touch, and network errors expose the vulnerability of current agents and threaten real-world GUI deployment.UI-TARS-7B-DPO and UI-TARS-1.5-7B experience substantial performance degradation under these conditions.
  • Benchmark: AgentHijack introduces 9 configurable common corruptions applied to OSWorld, producing 3,321 tasks for evaluating computer-use-agent robustness.
  • Proposed framework: AgentHijack-Agent integrates an action generator with enhanced grounding and an onlooker for behavioral summarization and environment checking.The framework uses data-augmented group relative policy optimization to strengthen grounding across diverse environments.
  • Experiments: Extensive experiments examine the weaknesses of current agents and the effectiveness of AgentHijack-Agent.

2. Related Work

Recent MLLM advances have driven computer-use agents, while existing benchmarks evaluate diverse computer tasks but leave a gap in comprehensive robustness assessment under common corruptions.

  • MLLM-based Computer-Use Agents: MLLMs such as GPT-4o, Claude, Gemini, and Qwen-VL support computer-use agents through visual-textual processing, instruction following, and screen-layout interpretation.These capabilities derive from pretraining on massive datasets.
  • Benchmarks for Computer-Use Agents: Mind2Web and WebArena simulate realistic web environments for evaluating computer-using agents.They are identified as pioneering benchmarks for realistic web-based evaluation.
  • Benchmarks for Computer-Use Agents: OSWorld evaluates computer-use agents across daily, office, and professional scenarios.It is described as offering comprehensive evaluations across a wide range of tasks.
  • Benchmarking Robustness: Existing benchmark efforts leave a critical gap in comprehensively assessing computer-using-agent robustness under common corruptions.The gap concerns robustness evaluation in environments affected by common, rather than necessarily adversarial, corruptions.

3. Benchmarking the Robustness

Section 3 formalizes computer-use agents as closed-loop POMDP decision-makers, defines corruption robustness separately from adversarial robustness, and introduces AgentHijack as a configurable benchmark with nine common corruptions applied to OSWorld tasks.

  • 3.1 Preliminary: Computer-use agents operate in a POMDP, selecting executable actions from observations in a closed loop until reaching a step limit or termination flag.The formulation uses states, observations such as screenshots, actions such as clicks or typing, and transition dynamics.
  • 3.3 AgentHijack Design: A case study shows UI-TARS-1.5-7B deviating in visual grounding, failing to assess prior-action consequences, becoming distracted, and making meaningless attempts under environmental errors.The observed failures occur when the agent encounters visual disruptors and unexpected operations.
  • 3.2 Robustness Definition: Corruption robustness measures average task performance under common corruptions, whereas adversarial robustness concerns completing uncommon, high-risk tasks.This distinction extends evaluation beyond average performance on otherwise ideal task environments.
  • 3.3 AgentHijack Design: AgentHijack provides 9 corruption types applied to the OSWorld task list to evaluate robustness during daily computer use.The benchmark supports generating variants through YAML modifications, including changing pop-up content or accidental-touch timing.
  • 3.3 AgentHijack Design: The corruption set includes pop-ups, resolution changes, marks, and subtitles that simulate disruptions from applications, hardware or settings, animations, and desktop overlays.These examples represent common environmental interference rather than direct adversarial intent.

4. Method

AgentHijack-Agent addresses corruption-induced failures through enhanced grounding, continuous onlooker-based behavior summarization, and initial environment checking. Its training combines task-success and action-format rewards within DA-GRPO, while replaying successful trajectories to mitigate sparse rewards.

  • Framework Overview: AgentHijack-Agent combines an enhanced-grounding action generator with an onlooker that summarizes environmental changes and checks the initial environment.The onlooker supports action generation with behavioral summaries and validates initialization before execution.
  • Motivating Observations: Visual disruptors cause inaccurate grounding, including unnecessary pop-up clicks and click-position deviations under resolution changes, marks, or subtitles.The method identifies grounding vulnerability as a primary failure mode in current agents.
  • Motivating Observations: Unexpected operations can make agents misattribute environmental changes to prior actions or focus on triggered content instead of the previous operation space.Examples include continuing with a triggered menu and attributing a window close to the preceding action.
  • Training Objective: DA-GRPO combines task-success and action-format rewards, while an experience replay buffer caches successful trajectories because successful trajectories are rare and rewards are sparse.When environments consistently remain clean, DA-GRPO degenerates into GRPO.
  • Behavior Summarization: The onlooker records external and agent-induced environmental changes as brief descriptions, transforming history into observations paired with behavioral summaries for robust decision-making.This addresses the limitation of histories that focus mainly on changes caused by the agent’s own actions.

5. Experiments

Experiments show that common corruptions substantially weaken computer-use agents, while AgentHijack-Agent improves success rates and remains robust across corruption intensity, content, location, and timing. Ablations further attribute these gains to reinforcement learning and the onlooker’s behavior summarization and environment checking.

  • Performance Comparison: 18.74% average success rate is achieved by UI-TARS-1.5-7B under corruption, versus 24.21% on clean data; AgentHijack-Agent improves over the basic model by 4.15%.The comparison covers various LLM-based agents across corruption scenarios.
  • Corruption Intensity: Performance gradually declines as corruption intensity increases, but AgentHijack-Agent consistently outperforms the base model across tested intensities.The study varies resolution scaling, UI-mark counts, accidental-touch frequency, and app-minimization frequency.
  • Corruption Content: AgentHijack-Agent maintains a steady improvement despite performance fluctuations caused by different pop-up, subtitle, and UI-mark contents.The content variations include different UI-mark shapes and colors.
  • Corruption Locations: AgentHijack-Agent maintains steady performance regardless of corruption location or execution timing, demonstrating robustness to spatial and temporal placement.Experiments vary subtitle-overlay locations and the execution steps of accidental touches and app minimizations.
  • Module Ablation: Removing reinforcement learning or the onlooker’s behavior summarization and environment checking causes a significant performance drop under different corruptions.The ablation compares the full framework with a base model without RL and a framework without the onlooker functions.
  • Onlooker Ablation: More powerful onlookers yield greater performance gains, but fine-tuned UI-TARS-1.5-7B is selected to balance performance and computational overhead.The alternatives include Qwen2.5-VL-72B-Instruct and Qwen3-VL-235B-A22B-Instruct.

6. Conclusion

The study introduces AgentHijack to evaluate computer-use agent robustness against common corruptions in realistic interactive environments. Experiments across nine corruption types reveal limitations in grounding, distraction resistance, and environmental-error detection, underscoring the importance of improving robustness.

  • Benchmark: AgentHijack evaluates computer-use agent robustness against common corruptions in realistic interactive environments.The benchmark is designed for robustness evaluation under imperfect interactive conditions.
  • Findings: Experiments cover nine typical corruption types and expose several critical limitations in existing agents.The reported limitations include insufficient grounding capability, distraction by unexpected operations, and failure to detect environmental errors.
  • Implications: The findings highlight the importance of improving computer-use agent robustness.The conclusion links the identified grounding, distraction, and error-detection limitations to the need for more robust agents.

Impact Statement … B. Visualization of Environment Corruptions

AgentHijack motivates robust computer-use agents for real-world workflows and establishes its benchmark on OSWorld, using screenshot-based observations, pyautogui actions, task-specific evaluation, and visualized GUI corruptions.

  • Impact Statement: Robustness evaluation and enhancement are necessary for reliable deployment of computer-use agents in real-world digital workflows.The research presents a standardized evaluation tool and a practical solution intended to improve agent reliability.
  • A. Details of OSWorld Environment: AgentHijack is established on the OSWorld environment to evaluate computer-use agents under common environmental corruptions.The paper provides additional details about OSWorld and AgentHijack in the appendix material.
  • A.1. Initial Environment Setup: OSWorld contains 369 real-world Ubuntu computer tasks spanning operating-system, office, daily-usage, professional, and workflow categories.The environment includes scenarios requiring assistance at intermediate stages, such as when software is already open or the computer crashes.
  • A.2. Observation Space: AgentHijack adopts screenshots as its input modality and uses 1920×1080 as the default screen resolution.OSWorld also supports Accessibility Tree inputs and combinations of screenshots with accessibility information.
  • A.3. Action Space: AgentHijack primarily uses OSWorld’s pyautogui action space for programmatic mouse and keyboard control.Pyautogui supports basic actions including mouse clicks and keyboard input, while avoiding additional action-space labels in prompts.
  • A.4. Reward Function: OSWorld evaluates each task with a dedicated getter function, evaluator function, and corresponding parameters in a complete configuration file.Getters extract key components such as modified files or displayed text, and evaluators determine task success from those components.
  • B. Visualization of Environment Corruptions: The corruption visualizations illustrate diverse GUI challenges and functional requirements that computer-use agents may encounter in real-world environments.The examples cover representative GUI corruption types, including interference from overlapping windows when multiple applications run simultaneously.

C. Detailed Implementation of Each Corruption

This section specifies Python-style implementations for nine environment corruptions. The procedures modify screenshots, applications, input actions, networking, or screen state to create controlled disruptions.

  • Visual corruptions: Pop-ups are rendered by locating coverable regions on clean screenshots, while marks place icons on randomly selected coverable screen areas.The pop-up implementation follows Zhang et al. (2025), and Algorithm 1 exposes parameters for size, scaling, edge thickness, position, overlap, and button or window strings.
  • Visual corruptions: Resolution corruption resizes each captured screen image using a configurable scale factor.Algorithm 2 computes the resized dimensions from the original image width and height multiplied by αscale.
  • Visual corruptions: Subtitle corruption draws configurable text at the top or bottom of the screenshot with specified font, colors, size, and padding.The algorithm calculates text dimensions before horizontally centering the subtitle and setting its vertical position.
  • Application and interaction corruptions: Multi-app corruption launches an application absent from the current environment, selecting from VS Code, Chrome, GIMP, LibreOffice, VLC, or Thunderbird.The procedure captures existing applications, avoids launching duplicates, and starts another application in the initial environment.
  • Application and interaction corruptions: The remaining procedures trigger accidental clicks, minimize applications, block network traffic while preserving local communication, or lock the screen at specified execution points.Accidental touch selects a button position, minimization uses a back-to-desktop hotkey, network error applies iptables rules, and verification uses the Win+L hotkey.

D. Further Explanation of Method · E. Case Study

The section explains DA-GRPO’s workflow: parallel corrupted-environment rollouts collect trajectory and reward data, while replaying historical positive trajectories prevents gradient vanishing when rewards are all zero. Its algorithm then estimates group-relative advantages and updates the policy using the DA-GRPO objective.

  • D. Further Explanation of Method: Figure 9 illustrates the data-augmented group relative policy optimization algorithm described in the section.The illustration provides a visual summary of DA-GRPO’s algorithmic workflow.
  • D. Further Explanation of Method: DA-GRPO deploys n parallel environments with random visual disruptors to collect trajectory and reward data for each task.The collected data are represented as {τ_i, r_i} for the parallel rollouts.
  • D. Further Explanation of Method: When all rollout rewards are zero, DA-GRPO retrieves a historical positive trajectory from the replay buffer.This fallback is intended to prevent gradient vanishing.
  • D. Further Explanation of Method: The algorithm initializes policy and reference models, samples dataset batches, and updates the old policy during iterative optimization.It uses the success-plus-format reward function, datasets D, and visual disruptors C.
  • D. Further Explanation of Method: For each task, the old policy samples G outputs in randomly corrupted environments before reward computation.The outputs are sampled according to π_θold(·|q) for tasks q in the batch.
  • D. Further Explanation of Method: The method computes group-relative advantages for each output token and maximizes the DA-GRPO objective to update the policy.The token-level estimate is denoted Â_i,j, where j indexes the token of output o_i.

E.1. Performance of UI-TARS-1.5-7B on AgentHijack

UI-TARS-1.5-7B exhibits distinct execution failures across AgentHijack corruptions, including unnecessary clicks, coordinate deviations, incorrect operations, and persistent actions despite blocked or altered environments. The representative trajectories document these failure modes across pop-ups, visual disruptions, multiple applications, accidental touches, minimization, network errors, and verification requirements.

  • Pop-ups: Under pop-ups, UI-TARS-1.5-7B conducts an unnecessary click even though the target button is present.This behavior is shown in the representative pop-up trajectory.
  • Visual disruptions: Resolution changes, marks, and subtitles cause UI-TARS-1.5-7B click positions to deviate from target positions.The same coordinate-deviation pattern appears across all three visual corruptions.
  • Multi apps: When facing multiple applications, UI-TARS-1.5-7B conducts operations in incorrect positions.The multi-application trajectory illustrates positional confusion during interaction.
  • Accidental touch: After an accidental touch, UI-TARS-1.5-7B focuses on the triggered save menu although the file has not been successfully created.The behavior combines menu focus with failure to confirm successful file creation.
  • Blocked environments: App minimization, network errors, and verification requirements trigger misattribution or persistent actions despite unavailable conditions.The agent misattributes window closure, continues acting without network access, and persists despite requiring an unknown password.

E.2. Performance of AgentHijack-Agent on AgentHijack · F. More Experimental Details · F.1. Corruption Setting

AgentHijack-Agent is presented as addressing weaknesses exposed by UI-TARS-1.5-7B, handling diverse corruptions through appropriate clicks, recovery, and continued operation. The experimental-details section specifies default corruption configurations, including mark properties and overlap behavior.

  • E.2. Performance of AgentHijack-Agent on AgentHijack: AgentHijack-Agent avoids unnecessary clicks when pop-ups appear.This behavior is illustrated in Figure 19.
  • E.2. Performance of AgentHijack-Agent on AgentHijack: AgentHijack-Agent accurately clicks target positions under resolution changes, marks, and subtitles.Figures 20–22 illustrate these three corruption cases.
  • E.2. Performance of AgentHijack-Agent on AgentHijack: AgentHijack-Agent operates in correct positions when multiple applications interfere.This behavior is shown in Figure 23.
  • E.2. Performance of AgentHijack-Agent on AgentHijack: AgentHijack-Agent continues an unsuccessful file operation after accidental touch corruption.Figure 24 presents this recovery behavior.
  • E.2. Performance of AgentHijack-Agent on AgentHijack: AgentHijack-Agent recognizes accidental app minimization, reopens the corresponding window, and continues operating.Figures 25 and the accompanying paragraph describe this sequence.
  • F. More Experimental Details: AgentHijack-Agent operates in repaired environments when facing network errors or verification.Figures 26 and 27 illustrate these repaired-environment responses.
  • F.1. Corruption Setting: The corruption-setting section defines default configurations for each corruption type, including mark number, size, shape, color, and button overlap.Table 5 summarizes the experimental corruption types and configurations.

F.2. Ablation Setting … F.3. Prompt Details

The ablation settings vary corruption intensity, content, and location to examine their effects, while the prompt details specify interfaces for baseline models and AgentHijack-Agent components. These prompts define screenshot-grounded action generation, action summarization, risk reminders, and model-specific action spaces.

  • F.2. Ablation Setting: The ablation experiments investigate corruption effects across varying intensities, types, and positions.The section provides detailed experimental settings for these ablations.
  • F.2.1. SPECIFIC RESOLUTION VALUES: Resolution-change intensities use scaling ratios of 0.75, 0.5, and 0.25.The corresponding specific resolution values are listed in the ablation table.
  • F.2.2. DETAILED CORRUPTION CONTENT: Pop-ups and subtitles use three distinct content variants for each corruption type.The selected variants are provided in the corresponding corruption-content table.
  • F.2.3. CORRESPONDING CORRUPTION LOCATION: Accidental touch and app minimization locations are divided into early, middle, and late phases across 15 execution steps.The specific execution steps for each phase are listed in the location table.
  • F.3. Prompt Details: Prompt details cover open-source models, close-source models, state-of-the-art GUI agents, and the proposed framework.The prompts define the experimental interfaces used across these agent categories.
  • F.3.1. PROMPT FOR OPEN-SOURCE AND CLOSE-SOURCE MODELS: Baseline-model prompts require screenshot-based prediction and pyautogui execution without screenshot capture or locateCenterOnScreen.Agents return Python action code or the special outputs WAIT, FAIL, or DONE.
  • F.3.2. PROMPT FOR ACTION SUMMARIZATION / F.3.3. PROMPT FOR REMINDING: The framework includes prompts for summarizing visual changes between before-and-after screenshots and reminding users about overlooked password or network risks.The summarizer describes the operation and its most significant visual change, while the reminder outputs a corresponding alert or None.
Loading 2605.25707v1…