Code Agent can be an End-to-end System Hacker: Benchmarking Real-world
  Threats of Computer-use Agent
Authors: name: Weidi Luo; name: Qiming Zhang; name: Tianyu Lu; name: Xiaogeng Liu; name: Bin Hu; name: Hung-Chun Chiu; name: Siyuan Ma; name: Yizhe Zhang; name: Xusheng Xiao; name: Yinzhi Cao; name: Zhen Xiang; name: Chaowei Xiao
Published: 2025-10-08 03:35:23

Abstract: Computer-use agent (CUA) frameworks, powered by large language models (LLMs)
or multimodal LLMs (MLLMs), are rapidly maturing as assistants that can
perceive context, reason, and act directly within software environments. Among
their most critical applications is operating system (OS) control. As CUAs in
the OS domain become increasingly embedded in daily operations, it is
imperative to examine their real-world security implications, specifically
whether CUAs can be misused to perform realistic, security-relevant attacks.
Existing works exhibit four major limitations: Missing attacker-knowledge model
on tactics, techniques, and procedures (TTP), Incomplete coverage for
end-to-end kill chains, unrealistic environment without multi-host and
encrypted user credentials, and unreliable judgment dependent on
LLM-as-a-Judge. To address these gaps, we propose AdvCUA, the first benchmark
aligned with real-world TTPs in MITRE ATT&CK Enterprise Matrix, which comprises
140 tasks, including 40 direct malicious tasks, 74 TTP-based malicious tasks,
and 26 end-to-end kill chains, systematically evaluates CUAs under a realistic
enterprise OS security threat in a multi-host environment sandbox by hard-coded
evaluation. We evaluate the existing five mainstream CUAs, including ReAct,
AutoGPT, Gemini CLI, Cursor CLI, and Cursor IDE based on 8 foundation LLMs. The
results demonstrate that current frontier CUAs do not adequately cover OS
security-centric threats. These capabilities of CUAs reduce dependence on
custom malware and deep domain expertise, enabling even inexperienced attackers
to mount complex enterprise intrusions, which raises social concern about the
responsibility and security of CUAs.