CaMeLs can use computers too: System-level security for computer-use agents

The paper proposes a system-level security design for computer-use agents (CUAs) that defends against prompt injection by strictly isolating trusted task planning from untrusted environment observations. The authors point out that CUAs need to continuously observe UI state to decide each step's action, which conflicts with the isolation required for security, while UI workflows, though dynamic, are structurally predictable. To this end they introduce NOVA (Navigating via Observation, Verification, and Action), which lets a trusted planner generate in one pass a branching plan covering all expected runtime states, and can call perception models within the plan to resolve runtime values such as UI coordinates. Evaluation on OSWorld shows that the design retains up to 57% of the performance of frontier models while improving the performance of smaller open-source models by up to 19%. The authors claim that single-pass planning can block arbitrary instruction injection, but additional measures are still needed to address Branch Steering attacks, which trick the perception model into directing execution toward an attacker-preferred branch, for example redirecting the agent to a malicious website.