Source-linked AI summary
CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environments
Yuxuan Li, Will Epperson, Wesley Deng, Zezhou Huang
TL;DR
Computer-use agents are increasingly delegated decisions on platforms whose incentives may conflict with users’ objectives, a setting largely missing from current evaluations. The paper introduces CAVEAT and finds that steering sharply reduces optimal purchasing; it diagnoses the failures and tests targeted interventions.
Problem
Current CUA evaluations provide little evidence about whether agents preserve user objectives when platforms operate as intended while favoring conflicting outcomes.
Source: §1 · p. 1Method
Results
78.6% to 17.3%: optimal purchase rate falls when marketplace steering mechanisms are enabled in matched tasks.
Source: §9 · p. 10Takeaways & Limitations
Evaluations of delegated agents should include whether they preserve user objectives when the environments in which they act have competing incentives.
Source: §9 · p. 10The study focuses on online marketplaces with well-specified objectives and unique optima, while transfer to other domains and richer preferences remains open.
Source: §8 · p. 10
Abstract
from arXiv · showhide
Computer-use agents (CUAs) increasingly act on behalf of users online. What happens when the environments they operate in have incentives that do not align with the user's? In online marketplaces, for example, platforms may favor some products over others, potentially steering agents away from the user's objective. Existing CUA benchmarks cover cooperative settings or explicit attacks, but do not test whether agents preserve user objectives when the environment itself has a stake in the outcome. We introduce CAVEAT, a controlled benchmark spanning nine marketplace environments and a taxonomy of eight common steering mechanisms. Across five model families, agents purchase the user-optimal product in 78.6% of matched-control episodes but only 17.3% when steering mechanisms are enabled. Larger models and increased reasoning improve robustness, but substantial failures persist. Our trajectory analysis and targeted ablations identify three points where steering enters the decision process: (1) agents distort the user's priorities, (2) prematurely narrow the set of alternatives they consider, and (3) commit before resolving decision-relevant evidence. Guided by this diagnosis, we develop CAVEAT-Harness, which directly targets these failure modes and raises user-optimal purchasing by 55.0%. Targeted post-training further improves a smaller open model. These results establish incentive robustness as a distinct challenge for delegated agents, diagnose how it fails, and show that targeted interventions can substantially improve it.
1 INTRODUCTION
The introduction frames incentive-misaligned environments as a gap in CUA evaluation, presents CAVEAT, and reports substantial steering-related failures that motivate targeted interventions.
1 INTRODUCTION
- Existing CUA evaluations provide little evidence about agents preserving user objectives when platforms pursue competing incentives while operating as intended.The introduction contrasts capability benchmarks in neutral environments with security benchmarks focused on explicit manipulation or compromise.Source: §1 · p. 1
- 78.6% to 17.3%: optimal product selection falls when steering mechanisms are enabled in matched marketplace tasks.The underlying task and product catalog remain fixed.Source: Figure 1 · p. 2, §1 · p. 2
- Trajectory analysis and ablations identify objective drift, premature search closure, and commitment before decision-relevant evidence is resolved.These failures involve losing sight of user priorities, narrowing alternatives too soon, and acting before resolving facts such as full price.Source: §1 · p. 2
- CAVEAT-Harness and targeted post-training are reported to mitigate the diagnosed failures through structured inference and CAVEAT-27B.The introduction reports that harness gains depend on the underlying model’s ability to follow the prescribed decision process.Source: §1 · p. 2
- CAVEAT evaluates end-to-end purchasing across nine high-fidelity marketplace environments and eight steering mechanisms drawn from commercial practice.The benchmark tests whether agents preserve user objectives when marketplace incentives conflict with them.Source: §1 · pp. 1–2
2 INCENTIVE-MISALIGNED ENVIRONMENTS
The paper defines incentive misalignment as conflict between an environment’s objective and the user’s, and evaluates robustness with matched decision problems.
2 INCENTIVE-MISALIGNED ENVIRONMENTS
- Optimal selection measures whether the chosen outcome is user-optimal, unlike task completion, which measures whether an outcome was successfully executed.Decision quality is measured as the fraction of tasks with an optimal selection.Source: §2 · p. 3
- An environment is incentive-misaligned when advancing its objective can favor outcomes outside the user-optimal set.The same environment objective may favor the user-optimal outcome in one task and a worse outcome in another.Source: §2 · p. 3
- A steering mechanism advances an environment’s objective by changing which options are surfaced, how they are presented, or the effort needed to inspect them.The paper distinguishes objective conflict from the agent’s robustness in preserving decision quality under that conflict.Source: §2 · p. 3
- Matched evaluations hold the request, feasible outcomes, decision-relevant facts, and user-optimal set fixed while varying steering mechanisms.This comparison isolates degradation induced by the environment’s choice architecture rather than a changed decision problem.Source: §2 · p. 3
3 CAVEAT: INCENTIVE-MISALIGNED MARKETPLACES
CAVEAT evaluates autonomous purchasing across nine browser-based marketplaces, using matched conditions that vary marketplace steering while keeping the underlying decision problem fixed.
3 CAVEAT: INCENTIVE-MISALIGNED MARKETPLACES
- CAVEAT covers nine browser-based marketplaces with domain-specific transaction flows that agents navigate autonomously through purchase or booking.Agents can search, inspect listings, use filters or sorting, and modify their carts; the benchmark prescribes neither a decision procedure nor how much to inspect.Source: §3 · p. 3
- Each scored request has one uniquely user-optimal option that satisfies its requirements and is jointly best on all stated preferences.This construction avoids requiring arbitrary weights between preferences.Source: §3 · p. 4
- Optimal purchase rate is the fraction of episodes in which the completed transaction matches the user-optimal option.Tasks are validated against structured product attributes and the full catalog.Source: §3 · p. 4
- The benchmark operationalizes an eight-family taxonomy synthesized from recurring marketplace-steering mechanisms documented in prior work and policy analyses.The taxonomy is presented in Table 1.Source: §3 · p. 4, Table 1 · p. 4
- Matched marketplace versions keep the request, products, facts, prices, availability, and optimal option fixed while varying the steering mechanisms.The control disables the mechanisms; the incentive-misaligned condition activates all eight.Source: §3 · p. 4
- CAVEAT-Standard contains 52 tasks across nine environments, while CAVEAT-Hard has five CAVEAT-Shop tasks with 2,112 products across 88 result pages.The Hard setting tests decision quality when strong candidates require broader marketplace exploration.Source: §3 · p. 4
4 EVALUATING CUAS UNDER INCENTIVE MISALIGNMENT
The evaluation compares model families on CAVEAT-Standard under matched conditions and examines how reasoning, scale, and model generation relate to robustness.
4 EVALUATING CUAS UNDER INCENTIVE MISALIGNMENT
- The main evaluation covers five model families on all 52 CAVEAT-Standard tasks in both matched conditions, with three repetitions per task.Additional configurations test reasoning, scale, and generation on CAVEAT-Shop; the strongest configuration is also evaluated on five Hard tasks with ten repetitions each.Source: §4 · p. 4
4.1 INCENTIVES SHARPLY DEGRADE USER-OPTIMAL PURCHASING
- 78.6% to 17.3%: activating steering reduces CAVEAT-Standard optimal purchasing by 61.3 percentage points in the matched comparison.The user request, catalog, product facts, prices, availability, and user-optimal option remain unchanged.Source: Figure 3 · p. 5, §4.1 · p. 5
- All five model families perform worse under misalignment, with drops ranging from 37.2 to 78.9 percentage points.GPT-5.6-Sol with low reasoning falls from 91.0% in control to 53.8%; Fara1.5-27B with its native harness falls from 81.7% to 3.3% on CAVEAT-Shop.Source: Figure 3 · p. 5, §4.1 · p. 5
- With other mechanisms disabled, sponsored placement alone lowers GPT-5.6-Sol-low optimal purchasing from 100% to 63.3%, preferential ranking to 75%, and drip pricing to 83.3%.The remaining five mechanism families produce smaller drops.Source: §4.1 · p. 5
- On CAVEAT-Hard, GPT-5.6-Sol with high reasoning achieves 90.0% optimal purchasing in control and 0.0% under misalignment across 50 episodes.The same requests and catalogs are used in both conditions.Source: §4.1 · p. 5, Figure 3 · p. 5
4.2 ROBUSTNESS IMPROVES WITH MODEL CAPABILITY
- More reasoning improves robustness: GPT-5.6-Sol rises from 51.7% at low reasoning to 90.0% at high, while GPT-5.5 rises from 12.0% at low to 50% at medium or high.The section reports that robustness nevertheless remains below performance on the corresponding matched-control decisions.Source: §4.2 · pp. 5–6
- At low reasoning, GPT-5.6 optimal purchasing rises from 0.0% for Luna to 11.7% for Terra and 51.7% for Sol, while tested GPT-5 scale variants remain at 0.0%.Across generations, low-reasoning rates rise from floor through GPT-5 to 12.0% for GPT-5.5 and 51.7% for GPT-5.6-Sol.Source: §4.2 · p. 6
5 WHERE INCENTIVE MISALIGNMENT ENTERS THE DECISION PROCESS
Reviewing 200 trajectories and conducting targeted analyses identifies three points where incentive-bearing environments can gain leverage: user priorities, search coverage, and unresolved evidence.
5.1 OBJECTIVE DRIFT
- Reversing the order of two equal-priority preferences changed the selected product in all 25 matched pairs, shifting choices toward the preference mentioned first.The diagnosis calls this objective drift: salient cues can change which parts of the user's objective dominate the comparison.Source: §5.1 · pp. 6–7
5.2 PREMATURE SEARCH CLOSURE
- Moving a suboptimal product into a sponsored position raised its visit rate from 45/60 to 60/60 and its purchase rate from 0/60 to 48/60.On CAVEAT-Hard, all 50 GPT-5.6-Sol-high failures stopped on page 1 of 88 while the optimum remained buried; the diagnosis calls this premature search closure.Source: §5.2 · p. 7
5.3 PREMATURE COMMITMENT WITH UNRESOLVED EVIDENCE
- In 23 cases where agents found the optimum but later excluded it, decision-relevant facts were misread, forgotten, or judged incorrectly, often by confusing list and payable prices.In a drip-pricing test with other mechanisms disabled, GPT-5.6-Terra at low reasoning made 35 suboptimal purchases in 60 runs, all of the promoted product; the diagnosis calls the broader failure premature commitment with unresolved evidence.Source: §5.3 · p. 7
6 MITIGATING INCENTIVE-INDUCED FAILURES
The section turns diagnosed steering failures into inference-time structure and targeted post-training. It evaluates whether these interventions improve purchasing robustness, alongside their interaction costs and transfer evidence.
6.1 CAVEAT-HARNESS: OPERATIONALIZING THE DIAGNOSIS
- On CAVEAT-Shop, GPT-5.6-Terra-low optimal purchasing rises from 11.7% with BrowserUse to 66.7% with CAVEAT-Harness; on CAVEAT-Hard, GPT-5.6-Sol-high rises from 0.0% to 80.0%.Prompting alone reaches 30.0% on Shop and 13.3% on Hard.Source: Figure 5 · p. 8, §6.1 · p. 8
6.2 CAVEAT-27B: LEARNING THE DECISION PROCEDURE
- On 16 non-laptop CAVEAT-Shop tasks, CAVEAT-27B reaches 22.9% with CAVEAT-Harness versus 4.2% for Qwen3.5-27B; on CAVEAT-Stay, it reaches 16.7%.Qwen3.5-27B reaches 0.0% on CAVEAT-Stay with either BrowserUse or CAVEAT-Harness.Source: Figure 5 · p. 8, §6.2 · p. 9
6.1 CAVEAT-HARNESS: OPERATIONALIZING THE DIAGNOSIS
- CAVEAT-Harness fixes a user-request-derived task specification and offers verification before purchase to check search completeness and unresolved or conflicting evidence.It uses only the request and ordinary browsing, not benchmark answers, hidden catalog state, or incentive metadata.Source: §6.1 · p. 8
- CAVEAT-Harness uses 2.6× runtime, 2.3× as many steps, and 2.3× as many tool calls as BrowserUse.The authors identify more efficient stopping and verification as a motivation for further work.Source: §6.1 · p. 8
6.2 CAVEAT-27B: LEARNING THE DECISION PROCEDURE
- CAVEAT-27B is trained first on synthetic demonstrations outside CAVEAT, then on corrected actions from its own rollouts on CAVEAT-Shop laptop development tasks.The second stage exposes the model to navigation errors and recovery states that static demonstrations do not cover well.Source: §6.2 · p. 9
7 RELATED WORK
CAVEAT is positioned alongside work on computer-use, shopping, and preference-following benchmarks, deceptive interfaces, and platform incentives. Its distinguishing focus is whether agents preserve user-optimal outcomes when environmental incentives shape the options they encounter.
Computer-use and shopping agents
- CAVEAT complements navigation, shopping, and preference-following benchmarks by fixing the user decision and varying the incentives shaping the environment.The cited benchmark areas include web and computer-use evaluations [Zhou et al. (2024); Deng et al. (2023); Xie et al. (2024)], shopping benchmarks [Yao et al. (2022); Ling et al. (2026); Wang et al. (2026)], and preference-following evaluations [Zhao et al. (2025); Jiang et al. (2025)].Source: §7 · p. 9
Agent security and deceptive interfaces
- Unlike work on prompt injection and deceptive interfaces [Evtimov et al. (2026); Debenedetti et al. (2024); Zhan et al. (2024); Cuvin et al. (2026); Shi et al. (2026); Guo et al. (2026); Li et al. (2026); Bansal et al. (2025)], CAVEAT varies environmental incentives and scores user-optimal choices from a full catalog.Its steering mechanisms present accurate information; degradation is associated with responses to the ordering, salience, and timing of true information.Source: §7 · p. 9
Platform incentives and consumer choice
- Research on platform objectives and consumer choice motivates CAVEAT’s incentive taxonomy [Xu et al. (2022); Mathur et al. (2019); Athey & Ellison (2011)].CAVEAT embeds these incentives in interactive environments with verifiable user-optimal outcomes.Source: §7 · p. 9
8 LIMITATIONS AND FUTURE WORK
The study’s evidence is bounded by controlled online-marketplace settings and a small transfer evaluation. The authors identify broader domains, richer preferences, and adaptive platform behavior as open extensions.
8 LIMITATIONS AND FUTURE WORK
- CAVEAT focuses on online marketplaces with well-specified objectives and unique optima, fixed steering mechanisms, and only a small CAVEAT-Stay evaluation of transfer beyond CAVEAT-Shop.The authors call for testing richer preferences, adaptive platform behavior, and transfer across broader environments, mechanisms, and domains.Source: §8 · p. 10
9 CONCLUSION
The conclusion frames incentive misalignment as a setting for evaluating delegated agents and reports substantial degradation under marketplace steering. It links the degradation to decision-process failures and reports improvement from inference-time structure and targeted post-training.
9 CONCLUSION
- Under matched decision problems, realistic marketplace steering reduces optimal purchase rate from 78.6% to 17.3%.The paper traces the degradation to objective drift, premature search closure, and commitment with unresolved evidence, then reports improved robustness from inference-time structure and targeted post-training.Source: §9 · p. 10