Title: MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agents
Venue: NeurIPS 2025
Accepted: yes
Keywords: OS

agents

LLM

VLM

api

tool use

adversarial attack

adversarial images

malicious image patches

MIP

robustness

safety

security

trustworthiness
Abstract: Recent advances in operating system (OS) agents have enabled vision-language models (VLMs) to directly control a user’s computer. Unlike conventional VLMs that passively output text, OS agents autonomously perform computer-based tasks in response to a single user prompt. OS agents do so by capturing, parsing, and analysing screenshots and executing low-level actions via application programming interfaces (APIs), such as mouse clicks and keyboard inputs. This direct interaction with the OS significantly raises the stakes, as failures or manipulations can have immediate and tangible consequences. In this work, we uncover a novel attack vector against these OS agents: Malicious Image Patches (MIPs), adversarially perturbed screen regions that, when captured by an OS agent, induce it to perform harmful actions by exploiting specific APIs. For instance, a MIP can be embedded in a desktop wallpaper or shared on social media to cause an OS agent to exfiltrate sensitive user data. We show that MIPs generalise across user prompts and screen configurations, and that they can hijack multiple OS agents even during the execution of benign instructions. These findings expose critical security vulnerabilities in OS agents that have to be carefully addressed before their widespread deployment.


Peer reviews:
comments: SUMMARY:
This paper investigates attacks on vision-language model-based OS agents, which execute APIs and thus pose significant security risks. The proposed attack involves using malicious image patches (MIPs) to induce the agent to invoke specific APIs. Experimental results demonstrate that MIPs are highly effective and generalize across different user prompts and screen configurations, revealing critical security vulnerabilities in OS agents.

STRENGTHS AND WEAKNESSES:
Strengths:
1. The topic of security of OS agent is very crucial, since OS agent is able to interact with real world. 
2. The paper is well-written, explaining how OS agent works and how the attack constraints are derived from OS agent working pipeline. 
3. The experiments are well-executed.

Weakness:
1. The robustness of the attack is not assessed: For example, when taking the screenshot, typically the image is compressed. Therefore, I suggest assessing whether the attack is still successful under common image corruptions, such as JPEG compression. Since one application of this attack requires posting the adversarial image online, experiment settings of relevant works on VLM data poisoning (which can work via posting poisoned images online) can be borrowed here, such as in [1]

[1] Xu, Yuancheng, et al. "Shadowcast: Stealthy data poisoning attacks against vision-language models." Neurips 2024.

QUESTIONS:
OS agents typically require multi-step execution. Have you observed any differences in the difficulty of launching an attack depending on whether the target objective involves more or fewer steps?

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-06-25

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work explores the extension of adversarial image patches to the OS agent setting. The authors demonstrate via empirical experiments that it is possible to craft malicious image patches that induce the agent to perform malicious actions. The methodology employed by the authors extends existing projective gradient approaches, and a variety of ablations are applied to demonstrate the robustness of the approach.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The problem is of critical interest to the community, as there are many open questions about the safety of deploying computer-using agents.\n- The experimentation demonstrates high attack success and reasonably strong invariance across previously unseen screenshots in the universal setup.\n- The approach of choosing a sub-region of the image is successful and makes the attack more broadly applicable to settings where the adversary may only have limited control over the screen pixels.\n\nWeaknesses:\n- The approach requires white box access to the target model, and also requires knowledge of the system prompt.\n- Only two malicious targets were explored. How were these selected?\n- The threats posed by the work merit further discussion of potential mitigations\n\nQUESTIONS:\n- Fig 2: please elaborate on what parts of the images are MIPs\n- The background may not always be visible - can other areas be targeted such as application icons in the task bar?\n- It might be unrealistic to expect access to the system prompt and some evaluations of ASR over variations in the prompt or perhaps removal of the system prompt entirely would be valuable. My intuition is that the ASR should remain high since the MIP may act to suppress any attention to the input text tokens.\n\n- The work is very similar in flavor to https://arxiv.org/html/2407.08970v1 which I don’t see in the citations. Like this work, that paper uses PGD to optimize input images to inject meta-instructions into the output, overriding the user request and yielding potentially damaging output. This work mainly extends that approach to an agentic setting where a) the attack may be triggered in a multi-step workflow, b) the stakes are considerably higher, and c) some additional factors, such as image parsing, may impact attack success. Please comment on whether this is an accurate characterization.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposal a novel attack method targeting multimodal OS agents -- \"Malicious Image Patches\". Since OS agents rely on screenshots for environmental perception and decision-making, attacker can create an image patch containing adversarial disturbances imperceptible to human eye. When this patch is captured by the OS agent, it can directly hijack the agent's underlying VLM, causing it to ignore normal user commands and instead generate and execute malicious code preset by the attacker. The authors formalize the generation of MIP as an optimization problem with multi-constraints. The optimization process aims to find a perturbation $\\delta$ that maximizes the probability of the VLM generating specific malicious instructions, without changing the screen parser's output, covering interface elements, and under the constraint of limited perturbation magnitude.\n\nThis paper demonstrates that MIP attacks are not only effective in specific scenarios but, more importantly, specially optimized \"universal MIPs\" can generalize to unknown user instructions, different screen layouts, and different screen parser components, even successfully triggering in the middle of multi-step task execution by the agent. Additionally, the paper shows that through joint optimization, a single MIP can simultaneously attack multiple different-sized and types of VLMs within the same model family (such as Llama-3.2 11b and 90b), greatly enhancing the real-world threat of the attack.\n\nSTRENGTHS AND WEAKNESSES:\nQuality\n\nStrength: 1. Rigorous Methodology. The design of the objective and constraints is very ingenious, which reflects the author's deep understanding of the non-differential, non-continuous aspect of the OS Agent's workflow. 2. Experiment design is comprehensive and reliable. The paper systematically evaluates the generalization capability of attacks across multiple dimensions: instructions, layout, parser, execution steps, and VLM models. Specifically, the experiments in \"Execution Step Transferability\" (Table 3) simulate scenarios where a proxy accidentally captures MIPs during the execution of benign tasks, significantly enhancing the real-world credibility of the attack. In addition, Various temperature settings were used in the experiment for sampling evaluation, and mean and standard deviation were reported, which enhances the reliability of the results.\n\nWeaknesses: The key assumption in the entire optimization model is $g(s) = g(s + \\delta)$, that small perturb $\\delta$ do not change the output of the non-differential screen parser $g$. The authors state in the text, \"fortunately, this constraint is usually satisfied in practice, since ε is small by design.\" This is a very strong assertion, but it lacks experimental data support. If the perturbation happens to cross a certain threshold in OCR or object detection, causing the parser output ( $p_{som}$ or $s_{som}$ ) to change, the premise of the entire attack no longer holds. While this is not fatal, the lack of discussion on the boundary of this assumption constitutes a minor logical flaw. This is not grounds for rejection, but it needs to be supplemented in the final version.\n\n---\n\nClarity \n\nStrengths: clear description and clearly defined terminologies. \n\nWeaknesses: None \n\n---\n\nSignificance\n\nStrength: 1. The MIP attack vectors revealed in this paper are more covert, harder to defend against, and more contagious (e.g., through social media) compared to known text prompt injection or deceptive pop-up attacks. 2. This work is almost certain to inspire a series of follow-up research, including stronger attack variants, targeted defense mechanisms (such as visual-textual consistency detection, adversarial purification, etc.), and more secure OS Agent architecture designs.\n\nWeaknesses: None\n\n---\n\nOriginality\n\nStrengths: 1. The authors creatively addressed how to bypass non-differential components and how to generate payloads under multi-constraint conditions (patch location, API format). \n\nWeaknesses: None\n\nQUESTIONS:\n# Regarding the robustness of the invariance assumption for the screen parser $g(s) = g(s + \\delta)$\n\nThe key premise of the entire optimization process is that the added adversarial perturbations $\\delta$ do not change the output of the screen parser $g$ . You mentioned that this assumption usually holds in practice, but you did not provide any quantitative evidence. This raises a question: where is the boundary for the validity of this assumption? For example, at what $\\epsilon$ value would it fail? Or, does this assumption still hold on complex screens containing a large amount of dense text or UI elements? If $g(s) ≠ g(s + \\delta)$ , would the attack fail immediately? Because at that point, the p_som and s_som received by VLM would change, thus destroying the carefully optimized input.\n\nSuggestions: It is recommended that the authors conduct an ablation study: after successfully generating MIP, deliberately fine-tune $\\delta$ until $g(s) ≠ g(s + \\delta)$ , then test the change in attack success rate. Or, statistically analyze how many percentage of gradient update steps in the optimization process would violate this constraint. If the authors can prove that the method is not sensitive to this, or that the attack success rate decreases smoothly rather than dropping to zero abruptly when the constraint is broken, this would greatly enhance the reliability of the methodology. Conversely, if the attack is extremely sensitive to this, then it is an important limitation that needs to be acknowledged.\n\n# About the patch placement constraints $s_{\\text{som}} \\odot \\mathbb{1}_{\\mathcal{R}} = 0$\n\n\nYour constraint requires that the malicious patch R cannot overlap with any UI elements detected by screen parsers. This is a very strong simplification. On real, highly dynamic, or cluttered screens (e.g., a desktop with multiple open windows and notifications), it may be difficult to find a sufficiently large and \"clean\" area R to embed the patch. The places where attackers most want to embed the patch (such as ad banners, the top of social media image feeds) are exactly the ones that may overlap with UI elements. Can your method be extended to handle this situation?\n\nSuggestions: Could this constraint be relaxed, for example, by allowing overlap with certain \"non-critical\" UI elements (such as plain text labels) and adding a regularization term in the optimization objective to minimize the semantic impact on these elements? Exploring this issue will directly relate to the generality of this attack in the real world.\n\n# Related to threats to black-box models and comparisons with contemporary work\n\nExperiments (Section 4.3) honestly demonstrate that MIPs are difficult to transfer to completely unknown VLMs. This suggests that the attack currently primarily targets white-box or gray-box scenarios (the attacker understands the architecture of the target VLM, at least the same series of models). However, many commercial OS agents may use closed-source proprietary models in the future. Does this mean the realistic threat of MIPs is mainly limited to the open-source ecosystem? Additionally, considering the work of Wu et al. [54], can you more specifically elaborate on the fundamental advantages of your \"direct hijacking\" method compared to their \"misleading caption model\" method in terms of attack capabilities (e.g., being able to generate more complex, more arbitrary malicious code)?\n\nSuggestions: It is suggested to delve deeper into the possibility of black-box attacks (e.g., using query-based attacks or model stealing techniques to approximate the target VLM) and the limitations of current methods in the discussion section.\n\nLIMITATIONS:\nThe author has already discussed some limitations of this method in Sections 4.3 and 5, particularly its insufficient transferability to unknown VLMs. This is commendable. \n\nThere are still several limitations that have not been fully acknowledged:\n\n1. The author mentions the direct harm of attacks but could further emphasize their potential \"worm-like\" effect. If the malicious act itself is \"sharing this post on social media,\" MIP can achieve self-propagation, causing widespread impact. Explicitly pointing this out would make the discussion on negative social impact more profound.\n\n2. The defense strategies proposed at the end of the paper (validators, consistency checks) are rather macroscopic. A more specific limitation is that current adversarial perturbations can be fragile against some simple preprocessing (such as JPEG compression, Gaussian blur). The authors did not discuss the robustness of their attacks against such common image transformations.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates a new class of adversarial attacks—Malicious Image Patches (MIPs)—targeting multimodal OS agents, which are agents capable of performing actions on a user's computer based on screenshots and language instructions. The attack involves embedding small adversarial image patches in benign-looking images (e.g., wallpapers or social media posts). When captured in a screenshot by an OS agent, these patches induce the agent to perform harmful actions such as navigating to malicious websites or causing memory overflows. The paper presents targeted and universal attacks, demonstrates transferability across screen parsers and execution steps, and evaluates their effectiveness using the Windows Agent Arena framework and various LLaMA-based vision-language models.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The problem is important and timely. As OS agents become more prevalent, investigating their security vulnerabilities is highly important.\n2. The adversarial objective is well-defined under realistic constraints (e.g., small patch size, non-interference with screen parser bounding boxes).\n\nWeaknesses:\n1. Limited novelty: The concept of using image patches for adversarial attacks is not new and has been widely explored in prior literature. While the paper adapts this idea to the OS agent setting, the core technical methodology (e.g., PGD under perceptual constraints) follows existing adversarial attack frameworks.\n2. Assumption of white-box access: The attack relies on access to model gradients and internal agent configurations, which may limit its practicality in black-box or deployed systems.\n3. Defense strategies underdeveloped: The discussion of defenses is relatively high-level and lacks concrete implementation or evaluation.\n4. Lack the comparison with related work.\n\nQUESTIONS:\nsee weakness\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 2, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-11"}