AbstractPerception errors can be exploited by swapping screen pixels.
The authors frame CUA's perception failure as a security vulnerability, visual confused deputy: the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.
Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.