SA-CUA: A Dual-LLM Framework Establishing Trust Boundaries for Computer-Use Agents
Start here
An arXiv paper released on October 13, 2026 proposes SA-CUA, a dual-LLM framework for building a reliable trust boundary for computer operation agents (CUA), enabling them to autonomously execute tasks involving untrusted content. The framework derives conservative deterministic rules from the accessibility tree, marks trusted regions in the privileged LLM's screenshots, and isolates trusted content from untrusted content; the human only needs to complete a one-time task description at the start of the task, and during the task a robust approval channel verifies information through trusted channels, allowing values from untrusted domains to enter trusted domains. The authors claim improvements compared to CaMeL-CUA.
Generated by AI from reports · Updated 29 days ago
Attention and developments
Attention, hourly
Now 33, 0% in 24 hours·Peak 33 (Nov 6 03:00)
Related research
This event's paper
- Towards Safe Autonomy for Computer Use
arXiv · 2026-10-13 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesToward Safe Autonomy for Computer-Operating Agents
The paper proposes SA-CUA, a dual-LLM framework that builds a reliable trust boundary for computer-operating agents (CUA), enabling autonomous execution on tasks involving untrusted content. The framework derives conservative deterministic rules from the accessibility tree, marking trusted regions in the privileged LLM's screenshots, isolating trusted from untrusted content. The human provides a single task specification at the start, and during the task a robust approval channel verifies information via trusted channels, allowing values from the untrusted domain to enter the trusted domain. The authors state that compared to CaMeL-CUA, SA-CUA maintains significantly higher task utility while keeping the attack success rate at zero.