Agents Can Be Manipulated Without Prompt Injection: Branch Steering Attacks and the COBRA Defense Architecture

Researchers from ETH Zurich, the University of Cambridge, Imperial College London and other institutions published the paper "Securing Computer-Use Agents Against Branch Steering Attacks," proposing branch steering attacks and presenting a system-level defense architecture, COBRA. The attack does not rewrite the agent's instructions; instead, it manipulates the external data the agent relies on when making judgments, causing it to execute along branches that were previously allowed but do not match the user's true intent. COBRA follows the idea of isolating trusted planning from untrusted execution, pre-specifying for each branch the allowed tools, access targets and parameter ranges, and performing deterministic verification at the boundaries of HTTP requests and MCP tool calls. The authors built STEER-Bench, containing 101 tasks, 9 scenario groups and 199 attack test units; the attack success rate was 94.4% for a standard ReAct agent, 89.5% for Dual-LLM, and COBRA reported 0%, with 4 false blocks among 138 normal test units.