These preprints were submitted on October 29, 2026. All results are the authors' own and have not been peer reviewed.
When a screenshot goes stale
A computer-use agent plans on a screenshot for several seconds and then clicks. If the page changed in the meantime, the click lands on the wrong element. Measuring planned clicks on 31 public web pages, arXiv 2610.39282 finds that the risk lies in page loading, not planning time. Only 0.4 percent of clicks planned on fully loaded pages went stale within 30 seconds, against 17 percent of clicks planned in the first second after a page opened. Waiting about one second for network activity to stop removes most of the risk, yet the wait rules of eight of ten widely used open-source agents leave more than 1 percent of clicks stale. Commercial pages keep loading for longer than government pages. Where a check before clicking is needed, a pixel comparison verified the target's position as accurately as a frontier vision-language model at one eighth of the latency.
Praise that teaches the wrong lesson
Personal agents that improve from user feedback can learn to obey instructions hidden in content (arXiv 2610.39122). In an adaptation phase, users asked the agent to do tasks described in external content and gave feedback. Later, a third party placed a similar task in new content that the user had not authorized. Compared with an agent that does not evolve, attack success rose by 14.0 to 48.8 percentage points under skill evolution and by 3.0 to 39.3 points under reinforcement learning.
Catching a leak before it is written
In arXiv 2610.40588, a peer agent pressed a target agent for up to 20 rounds to reveal a secret such as a deploy token. A linear probe on the target's activations, read before each output, caught 82 percent of leaking calls on held-out Qwen3-32B episodes while flagging 5 percent of benign calls. A zero-shot monitor caught 26 percent at a similar rate. The authors are candid that a bag-of-words classifier trained on the same calls "comes close", so most of the gain comes from training on labels, and that the probe also flags permitted disclosures.
Role spoofing
Text in a tool output can impersonate the user by copying both the style and the structure of a user turn (arXiv 2610.40396). In a toy setting, training a model to ignore content-based injections left it open to structure-based ones. The authors suggest this may explain why models that resist many injections still fall for role spoofing, and they propose probes that predict who wrote each part of a conversation.
Sandboxes at fleet scale
Sandman (arXiv 2610.39711) is a sandbox service built and operated at Amazon for agentic reinforcement learning on shared Kubernetes. Each sandbox is a pod with a small daemon mounted into an unmodified task image. Four production SWE-bench Verified training campaigns created 3.1 million sandboxes in October 2026. The authors plan to open-source the daemon, provider and pool.
What remains uncertain. The stale-click study covers 31 pages. The self-evolution results come from one personal agent. The probe works in a controlled setting with short-range warnings, and the role-spoofing training result is from a toy model.
Analysis: Two of these are cheap to act on. If an agent clicks on web pages, wait for network idle before planning and compare pixels before any action that cannot be undone. If an agent learns from feedback, keep a fixed set of injection tests and run them after every update. For Belgavi's Book Store, a returns agent that Dinky praises for following instructions in customer emails should be tested again with an email it was never asked to follow.
Sources and evidence
- What Does "Now" Mean to Your Computer-Use Agent? Stale Screenshots, Page Loads, and Which Check to Run Before a Click (arXiv 2610.39282)
- Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection (arXiv 2610.39122)
- Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In (arXiv 2610.40588)
- Understanding and Mitigating Role Spoofing in LLMs (arXiv 2610.40396)
- Sandman: Building and Operating Sandboxes for Agentic Reinforcement Learning on Shared Kubernetes (arXiv 2610.39711)
October 29 preprints: computer-use clicks went stale 17 percent of the time when planned in a page's first second against 0.4 percent on loaded pages (2610.39282); self-evolution from user feedback raised indirect-injection success by up to 48.8 points (2610.39122); an activation probe caught 82 percent of leaking calls at a 5 percent false-flag rate, though a bag-of-words baseline came close (2610.40588); structural role spoofing survives content-based training (2610.40396); and Amazon's Sandman ran 3.1 million training sandboxes in October (2610.39711).