When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents

Although computer-use agents (CUAs) hold significant potential to automate increasingly complex OS workflows, they can demonstrate unsafe unintended behaviors that deviate from expected outcomes even under benign input contexts. However, exploration of this risk remains largely anecdotal, lacking concrete characterization and automated methods to proactively surface long-tail unintended behaviors under realistic CUA scenarios. To fill this gap, we introduce the first conceptual and methodological framework for unintended CUA behaviors, by defining their key characteristics, automatically eliciting them, and analyzing how they arise from benign inputs. We propose AutoElicit: an agentic framework that iteratively perturbs benign instructions using CUA execution feedback, and elicits severe harms while keeping perturbations realistic and benign. Using AUTOELICIT, we surface hundreds of harmful unintended behaviors from state-of-the-art CUAs such as Claude 4.5 Haiku, Claude 4.5 Opus, and Operator. We further evaluate the transferability of human-verified successful perturbations, identifying persistent susceptibility to unintended behaviors across various other frontier CUAs. This work establishes a foundation for systematically analyzing unintended behaviors in realistic computer-use settings.

Computer-use agents (CUAs) are LLM-based agents capable of autonomously performing complex tasks across both Web and OS environments. Although these agents can improve productivity by automating complex digital workflows, they can also demonstrate unintended behaviors: unsafe agent actions that deviate from the user's intent that inadvertently emerge during typical benign usage. These severe behaviors are long-tail in nature and difficult to analyze as they emerge in rare, real-world scenarios. We introduce the first systematic framework for studying unintended behaviors in CUAs. We first present a concrete conceptual framework defining the key characteristics of unintended behaviors and the benign input factors that cause them. We then present AutoElicit, an automatic framework that perturbs user instructions to increase the likelihood of harm while keeping instructions realistic and benign to capture unintended behaviors. This allows us to proactively test harms within benign input scenarios instead of relying on anecdotal failures. Using AutoElicit, we discover consistent vulnerabilities to unintended behaviors across frontier CUAs. Our work provides the foundation for proactive and scalable discovery of long-tail risks before deployment and contributes towards improving the safety and reliability of future agents.