AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents

2026-04-03

AI Summary

This study systematically evaluates the safety risks posed by tool-using agents when they execute locally rational but globally harmful behaviors in multi-step tasks. To this end, we introduce the first benchmark for computer-based agents that captures novel safety challenges arising from contextual accumulation, repeated tool invocation, and step-wise dependencies, comprising 2,653 instances. Experiments across agent platforms—including Claude Code, OpenClaw, and IFlow—using foundation models such as Qwen3, Kimi, GLM, and DeepSeek reveal significant vulnerabilities in current systems. Notably, attacks driven by Qwen3-Coder achieve a 73.63% success rate on Claude Code, demonstrating that model alignment alone is insufficient to ensure agent safety in complex, multi-step environments.

Abstract

Computer-use agents extend language models from text generation to persistent action over tools, files, and execution environments. Unlike chat systems, they maintain state across interactions and translate intermediate outputs into concrete actions. This creates a distinct safety challenge in that harmful behavior may emerge through sequences of individually plausible steps, including intermediate actions that appear locally acceptable but collectively lead to unauthorized actions. We present \textbf{AgentHazard}, a benchmark for evaluating harmful behavior in computer-use agents. AgentHazard contains \textbf{2,653} instances spanning diverse risk categories and attack strategies. Each instance pairs a harmful objective with a sequence of operational steps that are locally legitimate but jointly induce unsafe behavior. The benchmark evaluates whether agents can recognize and interrupt harm arising from accumulated context, repeated tool use, intermediate actions, and dependencies across steps. We evaluate AgentHazard on Claude Code, OpenClaw, and IFlow using mostly open or openly deployable models from the Qwen3, Kimi, GLM, and DeepSeek families. Our experimental results indicate that current systems remain highly vulnerable. In particular, when powered by Qwen3-Coder, Claude Code exhibits an attack success rate of \textbf{73.63\%}, suggesting that model alignment alone does not reliably guarantee the safety of autonomous agents.

Problem

• computer-use agents
• harmful behavior
• safety benchmark
• multi-step actions
• autonomous agent safety

Innovation

• computer-use agents
• harmful behavior benchmark
• sequential safety evaluation
• tool-mediated autonomy
• context-aware alignment