Securing computer-use agents is being treated as a lifecycle problem

A new framework paper argues that agent security cannot be bolted on at the model layer because the failure modes are distributed across architecture, deployment and operation. It is the first treatment that reads like it was written by people who have run one in production.

An arXiv paper this month proposes a unified architecture-lifecycle framework for computer-use agents, and its central claim is a structural one: the reliability and security failures of an agent are not concentrated at the model. They are distributed across how it is architected, how it is deployed, and how it is operated — and a control placed at only one of those layers cannot address failures originating in the others.

This matters because the prevailing mitigation strategy is model-layer. Better refusals, better instruction hierarchies, better prompt-injection resistance. Those are worth having and they do not address an agent that has been given credentials broader than its task, or one whose action log is not reviewable after the fact, or one that succeeds at the wrong objective quickly and irreversibly.

The framing lines up with what the benchmark spread already suggests. A system that scores 87% on live-site navigation and 58.1% on programmatically-verified tasks is a system whose failures are not evenly distributed, and the difference between those two numbers is roughly the space in which an unsupervised agent does something expensive.

The practical reading for teams deploying now: scope credentials to the task rather than the agent, make the action log the primary artefact rather than the output, and assume the interesting failures are the confident ones. The headline success rates are not measuring this.

arXiv — Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability → · Automation Anywhere — AI Agent Benchmarks: The 2026 Enterprise Evaluation Guide →