The report
MMA-SafetyBench, published on October 14, tests what happens when a multimodal agent encounters instructions presented as ordinary visual interface content. An attacker can plant a forged alert, dialog, page component, document element or video-frame instruction while the agent is carrying out a legitimate task. The attempted boundary crossing occurs when material being observed becomes authority for the next action.
The researchers assembled 1,083 adversarial trajectories across five areas: web automation, desktop GUI use, mobile navigation, documents and video. Nine evaluated systems produced a highest configuration-specific attack-success rate of 87.96%. A separate semantic-compromise metric reached 98.09%, but it can include disruption or redirection that does not meet the attacker's exact target. Neither maximum is an average across the entire benchmark. The Case and its evaluated Claims distinguish the two denominators.
This test matters because a legitimate workflow needs screenshots and displayed text as evidence. A fake system-level warning placed inside a webpage can resemble a higher-priority message in an image even though it is controlled by the page owner. The reported controls find that a safety-priority prompt lowers attack success, but does not eliminate the visual-instruction problem. The benchmark assesses generated decisions and target-matching outcomes, not completed transfers, stolen credentials or external filesystem changes.
A production defense needs two separately tested properties: the agent should treat observed content as data rather than a new instruction source, and the execution layer should independently restrict irreversible or privileged tool effects. A lower benchmark attack-success score does not itself establish the second property.