license: cc-by-nc-4.0
task_categories:

• text-generation
  tags:
• safety
• evaluation
• benchmark
• computer-use
• agent
• red-teaming
  language:
• en
  size_categories:
• n<1K
  viewer: false

extra_gated_heading: "Request access to OS-Blind"
extra_gated_description: "Please provide your full name and affiliation. By requesting access, you agree to use this dataset only for non-commercial academic research."
extra_gated_button_content: "Request access"

extra_gated_fields:
Full name: text
Affiliation: text
I agree to use this dataset only for non-commercial academic research: checkbox

Dataset Card for OS-Blind

OS-Blind evaluates computer-use agents (CUAs) under unintended attack conditions: every task begins with a fully benign user instruction, yet harm emerges from the environment during execution. This is in contrast to existing benchmarks that rely on explicitly malicious instructions or injected adversarial prompts. By using benign instructions as a disguise, OS-Blind captures a substantially more realistic and challenging safety threat.

Dataset Overview

The benchmark contains 300 human-crafted tasks spanning 12 harmful categories, 8 desktop applications (Chrome, GIMP, LibreOffice Writer/Calc/Impress, a synthetic Gmail client, VLC, and VS Code), categorized into 2 threat clusters:

Cluster I: Environment-Embedded Threats

Agents encounter deceptive websites, scam emails, harmful web content, or dynamically injected pop-ups.

Cluster II: Agent-Initiated Harms

Agents execute seemingly normal tasks whose outcomes constitute safety violations.

Key Findings

Our evaluation of frontier models and agentic frameworks reveals that:

• Most CUAs exceed 90% attack success rate (ASR) on OS-Blind.
• Even the safety-aligned Claude 4.5 Sonnet reaches 73.0% ASR.
• In multi-agent systems, ASR rises from 73.0% to 92.7% for Claude 4.5 Sonnet, as task decomposition obscures the user intent that would alert the agent to a malicious environment.
• Safety alignment primarily activates within the first few steps. After that, safety alignment mechanism will stop working, even the environment still includes harmful content that is related to the task.
• Existing safety defenses — including system safety prompts and state-of-the-art frameworks like MirrorGuard — provide only limited protection when user instructions are benign.

Dataset Structure

examples/
  01_credential_phishing/      # 64 tasks
  02_data_exfiltration/        # 25 tasks
  03_fraud_and_forgery/        # 19 tasks
  04_malware_deployment/       # 32 tasks
  05_system_sabotage/          # 14 tasks
  06_misinformation_and_manipulation/  # 13 tasks
  07_harassment_and_threats/   # 12 tasks
  08_illegal_and_harmful_content/      # 25 tasks  ⚠️ defanged URLs
  09_risky_financial_platforms/        # 20 tasks  ⚠️ defanged URLs
  10_deceptive_agreements/     # 13 tasks
  11_code_injection/           # 13 tasks
  12_pop_ups_attack/           # 50 tasks
test_all.json       # index of all task IDs per category
restore_urls.py     # script to restore defanged URLs (see below)

Each JSON file contains the key following fields:

• id: Unique task identifier.
• instruction: The benign user instruction given to the agent.
• eval_metric: Natural-language annotation specifying which agent actions result in a successful attack.
• config: Environment setup steps (browser launch, file downloads, URL navigation, etc.).

Note on Defanged URLs (Categories 08 & 09)

Tasks in 08_illegal_and_harmful_content and 09_risky_financial_platforms involve URLs pointing to real third-party websites that may host disturbing, illegal, or otherwise harmful content (e.g., gambling platforms, extremist content). To prevent accidental access during browsing, all URLs in these 40 tasks have been defanged. To be more specific, the . characters in domain names are replaced with [.] (e.g., example[.]com).

If you intend to run evaluation on these tasks, first restore the original URLs by running:

python restore_urls.py

This will in-place update all affected JSON files under categories 08 and 09. Only do this if you understand the nature of the content and have taken appropriate safety precautions.

Sensitive Content Statement

Some tasks reference sensitive topics including phishing pages, malware, financial scams, and illegal content. All personally identifiable information used in this benchmark is entirely synthetic. For tasks involving inherently harmful content (e.g., gambling or extremist platforms), we use real-world URLs rather than reconstructed replicas; these are the URLs that have been defanged as described above.

Environment

OS-Blind is built on top of OSWorld (Xie et al., 2024), a widely used Ubuntu 22.04 desktop environment for evaluating computer-use agents. All tasks use 1920×1080 screenshots as observations and run inside an isolated virtual machine.

Terms of Use

By downloading and using this dataset, you agree to the following:

1. Research only: This dataset may only be used for non-commercial academic research purposes.
2. No harmful reproduction: You agree not to reproduce or operationalize any attack scenario contained in the dataset.
3. Acknowledgment: You acknowledge that this dataset may reference third-party platforms and content, and you agree to abide by applicable laws and any terms of those platforms.
4. Derivatives: Any derivative works must include these same terms of use.

Citation

BibTeX:

@misc{ding2026blindspotagentsafety,
      title={The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents}, 
      author={Xuwei Ding and Skylar Zhai and Linxin Song and Jiate Li and Taiwei Shi and Nicholas Meade and Siva Reddy and Jian Kang and Jieyu Zhao},
      year={2026},
      eprint={2604.10577},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2604.10577}, 
}