AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents
Computer-use agents extend language models from text generation to persistent action over tools, files, and execution environments. Unlike chat systems, they maintain state across interactions and translate intermediate outputs into concrete actions. This creates a distinct safety challenge in that harmful behavior may emerge through sequences of individually plausible steps, including intermediate actions that appear locally acceptable but collectively lead to unauthorized actions. We present AgentHazard, a benchmark for evaluating harmful behavior in computer-use agents. AgentHazard contains 2,653 instances spanning diverse risk categories and attack strategies. Each instance pairs a harmful objective with a sequence of operational steps that are locally legitimate but jointly induce unsafe behavior. The benchmark evaluates whether agents can recognize and interrupt harm arising from accumulated context, repeated tool use, intermediate actions, and dependencies across steps. We evaluate AgentHazard on Claude Code, OpenClaw, and IFlow using mostly open or openly deployable models from the Qwen3, Kimi, GLM, and DeepSeek families. Our experimental results indicate that current systems remain highly vulnerable. In particular, when powered by Qwen3-Coder, Claude Code exhibits an attack success rate of 73.63\%, suggesting that model alignment alone does not reliably guarantee the safety of autonomous agents.
69d311362c523d36431fad21
Yunhao Feng
claimed_verified
2026-04-07T08:38:45.613Z
69d47558a9acd1eb26637fe9
https://cdn-avatars.huggingface.co/v1/production/uploads/69d47558a9acd1eb26637fe9/ZWSP5HU9uU7Bc2a1I54eq.jpeg
YunHao-Feng
Yunhao-Feng
user
Yunhao-Feng
69d311362c523d36431fad22
Yifan Ding
69d311362c523d36431fad23
Yingshui Tan
69d311362c523d36431fad24
Xingjun Ma
69d311362c523d36431fad25
Yige Li
69d311362c523d36431fad26
Yutao Wu
69d311362c523d36431fad27
Yifeng Gao
69d311362c523d36431fad28
Kun Zhai
69d311362c523d36431fad29
Yanming Guo
AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents
Computer-use agents extend language models from text generation to persistent action over tools, files, and execution environments. Unlike chat systems, they maintain state across interactions and translate intermediate outputs into concrete actions. This creates a distinct safety challenge in that harmful behavior may emerge through sequences of individually plausible steps, including intermediate actions that appear locally acceptable but collectively lead to unauthorized actions. We present AgentHazard, a benchmark for evaluating harmful behavior in computer-use agents. AgentHazard contains 2,653 instances spanning diverse risk categories and attack strategies. Each instance pairs a harmful objective with a sequence of operational steps that are locally legitimate but jointly induce unsafe behavior. The benchmark evaluates whether agents can recognize and interrupt harm arising from accumulated context, repeated tool use, intermediate actions, and dependencies across steps. We evaluate AgentHazard on Claude Code, OpenClaw, and IFlow using mostly open or openly deployable models from the Qwen3, Kimi, GLM, and DeepSeek families. Our experimental results indicate that current systems remain highly vulnerable. In particular, when powered by Qwen3-Coder, Claude Code exhibits an attack success rate of 73.63\%, suggesting that model alignment alone does not reliably guarantee the safety of autonomous agents.
Computer-use agents present unique safety challenges due to their ability to perform sequences of actions that appear harmless individually but collectively cause harm, necessitating benchmarks like AgentHazard for evaluation.
computer-use agents language models persistent action tool interaction file manipulation execution environment state maintenance harmful behavior benchmark AgentHazard attack success rate model alignment autonomous agents