Security risks created when untrusted content can steer an agent workflow.
A computer-use agent treats pixels, accessibility data and interface state as both evidence and an action surface. Security must bind intent to effects beyond the screen.
Investigators need more than chat transcripts. Preserve identity, instructions, retrieved context, model and tool versions, policy decisions, credentials, network events and actual state changes.
A useful agent threat model follows data, instructions, identity, tools and state across trust boundaries. This method turns the map into test cases and control decisions.
An agent becomes especially risky when it can read secrets, ingest attacker-controlled material and communicate or act outside the boundary. Design the workflow to break that combination.
A dramatic exploit is a discovery, not a decision rule. Translate it into a threat condition, required control, repeatable regression and release consequence.
Tool-using agents join untrusted input, probabilistic decisions and privileged action. CISOs should govern that path as a security system, not a chatbot feature.
Prompt injection becomes consequential when untrusted content can steer a model towards privileged tools. Reduce the blast radius by redesigning the workflow around trust and authority.
KEEP EXPLORING
Read the method, assumptions and questions to ask.