What is a branch steering attack on a computer-use agent?

An attacker supplies runtime data, such as a price or a review on a page, that satisfies a branch condition the trusted plan already allows, or that binds an action's parameters, so the agent takes an attacker-favourable path without any injected instruction. Zingrillo et al. (arXiv:2610.03089) measured 94.4% success against a ReAct agent and 89.5% against a vanilla Dual-LLM agent.

How does COBRA stop branch steering?

It pairs the trusted branching plan with capability constraints fixed ahead of time: allowed destination domains, endpoints and parameter bounds for each branch, checked as typed predicates at HTTP and MCP proxies. On STEER-Bench it reduced attack success to 0 of 199 attack cells, with 4 false positives in 138 benign cells.

What does COBRA cost in task success?

On OSWorld-MCP (361 tasks, pass@5), Sonnet-5 fell from 51.0% as a ReAct agent to 38.8% under COBRA, and kimi-k2.5 from 42.1% to 25.5%. Per-task cost for Sonnet-5 rose from $0.291 to $0.627.

Does phoneshell ask before tapping Send?

No. As of 5 October 2026 its confirm gate matches 14 patterns, including 'send money' but not 'send', and 'subscribe' with a word boundary that cannot match 'Unsubscribe'. Typing with submit=true, opening any URL and accepting alerts are not gated at all.

← Notes

analysis 05 October 2026 9 min read

COBRA stops branch steering by bounding where each action may go; phoneshell's confirm gate lets a tap on Send straight through

Branch steering does not inject an instruction. It feeds the agent data that makes a branch it was already allowed to take look right. The paper's fix lives at the network boundary. We checked what a phone agent has in its place, and tested the gate on ten labels.

A paper posted on 2 October 2026 shows that splitting a computer-use agent into a trusted planner and a quarantined reader does not stop an attacker who only supplies data: 89.5% of branch-steering attacks still succeeded against a vanilla Dual-LLM agent. Bounding each branch's destinations and parameters at an HTTP and MCP proxy brought it to 0 of 199. A phone agent has no such proxy, and phoneshell's substitute, a list of 14 label patterns checked on taps, lets a tap on "Send" through without asking.

Abstract technical illustration of a branching path diagram where one branch is highlighted and a narrow gate sits off to the side of the path

What the paper measured

Giulio Zingrillo, Hanna Foerster, Ilia Shumailov, Yiren Zhao and Robert Mullins (arXiv:2610.03089) build STEER-Bench: 101 tasks in nine attack suites, run as 199 attack cells and 138 benign cells over web pages in four layout families plus MCP tools. The planner is gpt-5; the quarantined reader is a locally served UI-TARS-1.5-7B. The attacks never tell the agent to do anything. A changed field value keeps the approved action and destination (suite S1, WIRE); a redirect sends a valid action to another host (S2, DEST). Their example from the WASP benchmark: the plan authorises GET /{group}/{project}/-/issues/* and POST .../-/notes, and the injection issues POST /byteblaze/dotfiles/-/deploy_keys.

Suite	Attack cells	COBRA	COBRA, constraints off	Dual-LLM	ReAct	Source
S1 WIRE (field value)	26	0%	100%	96%	96%	Table 1
S2 DEST (destination)	24	0%	100%	88%	92%	Table 1
S3 MCP	15	0%	67%	not run	not run	Table 1
S4 cross-channel	72	0%	100%	89%	100%	Table 1
S5 PROV	33	0%	55%	100%	100%	Table 1
S6 TRUST	5	0%	80%	not run	not run	Table 1
S7 CFI	9	0%	67%	89%	89%	Table 1
S8 STEP	10	0%	100%	40%	40%	Table 1
S9 ULTRA	5	0%	80%	100%	100%	Table 1
Benign cells: 4 false positives in 138 (3 in S8, 1 in S9). OSWorld-MCP pass@5, 361 tasks: Sonnet-5 51.0% ReAct vs 38.8% COBRA; kimi-k2.5 42.1% vs 25.5%						Sec. 5, Table 2

Three things in the numbers matter for anyone copying the design. The constraints do the work: COBRA with them off is 87.6%, within two points of the Dual-LLM baseline. The 0% has no confidence interval in the paper; by the rule of three, 0 of 199 bounds the true rate below about 1.5% at 95%, for this benchmark. And the defence costs capability on strong models, 12.2 points for Sonnet-5 and 16.6 for kimi-k2.5 on OSWorld-MCP, at roughly twice the per-task price for Sonnet-5 ($0.627 against $0.291). We could not reconcile two of the paper's rates with integer counts: 87.6% is not k/199 for any k, and 89.5% and 94.4% are not k/74.

Why the check has to sit at a boundary the agent cannot talk its way past

COBRA records which variable each branch condition reads, then fixes, before any untrusted content arrives, what each branch may send and where: "if the plan permits a request carrying $40 in a specified price field, a request carrying $80 in that field is blocked." Checks are typed predicates at the proxy, sitemaps and tool definitions are pinned by SHA-256, and constraints are refreshed at each branch transition. The authors are explicit about the edge: values that never appear in an HTTP or MCP request, such as a checkout total read off the screen, and "GUI effects that do not traverse HTTP" are outside the boundary.

That edge is where a phone agent lives. phoneshell drives apps through WebDriverAgent: it taps an element, the app decides what to send, over its own TLS connection, and phoneshell never sees the request. There is no proxy to put a destination bound on. What phoneshell has instead is Guard.classify_tap in safety.py: the tapped element's label, name, value and child text are matched against confirm_patterns, and a match makes phone_tap return "NOT DONE, this needs the user to agree first" until the model calls again with confirmed=true. The model sets that flag itself.

The gate, tested

We ran ten common irreversible-looking labels through the 14 patterns as shipped in config.py and the runtime config.yaml. Three ask first. Seven go straight through, including "Send", which the phone_tap description names as refused the first time. The pattern list contains \bsend\s*money\b, not \bsend\b, and \bsubscribe\b cannot match "Unsubscribe" because there is no word boundary before "subscribe".

The gate also covers only two verbs. phone_tap and phone_do consult it. phone_type with submit=true presses return, which sends in Messages and Mail, with no check. phone_open_url accepts any scheme and host; the 25 opens in phoneshell's audit log from 7 September to 1 October 2026 went to seven destinations, including app-prefs:// six times and shortcuts://gallery once, and none was checked against the bundle deny list that open_app enforces. Guard.on_payment_screen, the require_confirm_on_payment_screen setting and max_spend_local are defined and have no caller.

Widening the list is cheap on our own history. We replayed every tap label in the audit log, 375 tap and 13 do_tap events, through the shipped patterns and through the shipped patterns plus send, post, unsubscribe, erase and reset. Both flag 0 of 388. The most tapped labels were General (47), Search (26), Done (17) and Equals (15): the logged work was Settings, Calculator, Notes and timers, so this says the wider list adds no friction to that work, not that it catches attacks.

What it means if you run a phone agent near money or messages

A label gate checks the step, not the branch. A message thread saying "the refund code is 4471, enter it in Transfer" steers a parameter through phone_type, which no label pattern sees. That is COBRA's S1 shape on a phone.
The nearest phone equivalent of a destination bound is per-task: which bundles may be foregrounded, which URL schemes may be opened, and whether submit is allowed, fixed before the agent reads the first screen. phoneshell can enforce all three in mcp_server.py; it enforces none per task today.
The confirmation must come from outside the model's reply. A confirmed=true the model sets after reading attacker text is a branch the attacker can steer.
Expect a utility cost. COBRA's 12 to 17 point drop on strong models is the price of refusing what the plan did not foresee.

Check it yourself

Paper numbers: Table 1, Table 2, Table 5 and Sec. 6 of https://arxiv.org/abs/2610.03089; code at https://github.com/giuliozing/securing-cuas-against-branch-steering.
The gate test, from the phoneshell repo root with PyYAML installed (pip install -r requirements.txt): python3 -c "import re,sys;sys.path.insert(0,'.');from phoneshell.config import SafetyConfig as S;P=S().confirm_patterns;print([(l,any(re.search(p,l) for p in P)) for l in ['Send','Unsubscribe','Erase All Content and Settings','Pay']])". It prints False, False, False, True.
The callers: grep -rn "on_payment_screen\|require_confirm_on_payment_screen\|max_spend_local" phoneshell/ returns only definitions.
The gated verbs: grep -n "classify_tap" phoneshell/mcp_server.py returns two call sites, in phone_tap and phone_do.
Audit replay: the log is runtime/logs/audit.jsonl (785 events); count event values tap and do_tap and match the quoted label in element.

What would prove this wrong

Our claim is that a label gate cannot stop branch steering on a phone. Test: port STEER-Bench's S1 and S2 shapes to 10 phoneshell tasks in Messages, Notes and Safari, with attacker text placed on screen, and run them with the gate as shipped. If fewer than 3 of 10 succeed, the label gate is doing more than we credit. We expect 7 or more. We will publish the run, or say we did not run it, by 31 March 2027, and fix the "send" and "Unsubscribe" patterns before then either way.