Action Hijack and Irreversibility: Blast Radius When an Agent Can Click Anything

The frightening property of a computer-use agent is not that it can be tricked — every system can be tricked — but what a single successful trick can reach. A tool-calling agent that is manipulated invokes a function from a fixed list, and the worst case is bounded by that list. A screen-driven agent that is manipulated clicks a real control in real software, and the worst case is bounded only by what that software can do: delete a file, send a message, authorize a payment, change a setting, exfiltrate data, grant access. OSWorld showed that agents in this class operate genuine operating systems across file input and output and multi-application workflows, which means their consequence set is the union of everything the reachable software exposes to a user. This article is about that consequence set — the blast radius of an agent action — and the single axis that governs how much any one action can cost: whether it can be undone. Grounding attacks decide where an action lands; this piece is about what happens when it lands somewhere it should not, and how to keep that from being catastrophic.

From Click to Consequence

The act stage is where an agent's intent — honest or hijacked — becomes a real effect on real software. Blast radius is the term for the scope of consequences a single action can cause: how much data, how many systems, how much money or access one click or keystroke can touch. It is a property of the action and the environment together, not of the agent's intelligence, and it is the quantity a defender must actually bound.

Reasoning about blast radius separately from reasoning about attacks is what makes containment possible. An attacker's job is to get the agent to take some action it should not; the defender's job is to ensure that even a successful manipulation reaches as little as possible. These are different problems, and conflating them leads teams to pour effort into preventing every manipulation while leaving the consequences of the manipulations they miss unbounded.

The uncomfortable truth is that manipulations will be missed. Grounding is unreliable, the display is untrusted, and no input filter is perfect, so a mature design assumes some bad actions will fire and asks how small their effect can be made. Everything below is in service of that question.

The Unbounded Action Space

A tool-calling agent's action space is a schema: a known list of functions with typed arguments, which a defender can enumerate and reason about in advance. A computer-use agent has no such boundary. Because it acts through the graphical interface, its available actions are whatever the software currently on screen offers a user, and that set changes as the agent navigates. OSWorld demonstrated the breadth concretely, with agents operating real desktop applications, performing file input and output, and carrying out workflows that span multiple applications on a real operating system.

The consequence is that the action space cannot be enumerated from a manifest. It is the union of every effect reachable through every application the session can open, and it grows with the agent's privileges and connectivity. This is why a text-agent security posture — validate the arguments, allow-list the functions — does not transfer directly: there is no fixed function list, only a raw interface over an open-ended set of programs.

For a defender the implication is that the action space must be bounded from the outside, by controlling what the agent can reach, rather than from the inside, by enumerating what it can do. The reachable set of applications, files, and destinations is the real action space, and it is the thing to shrink.

Irreversibility: The Axis That Matters

Not all actions carry the same risk, and the axis that separates them is reversibility. A reversible action can be undone at little cost — navigating, scrolling, opening a document, typing into a draft. A costly-reversible action can be recovered but only with effort — moving a file, changing a setting that can be changed back, sending a message that can be retracted with difficulty. An irreversible action cannot be meaningfully undone — sending a message that is immediately read, authorizing a payment, deleting data without a backup, granting access, exfiltrating information. Once an irreversible action fires, the damage is done.

This axis is what turns blast radius from an abstract concern into a prioritization. The danger concentrates almost entirely in irreversible and expensively-reversible actions, because those are the ones a hijack can convert into lasting harm. A mis-grounded scroll is noise; a mis-grounded 'authorize' is an incident. A defender who classifies actions by reversibility can spend protection where it matters instead of gating everything uniformly, which would make the agent useless.

The practical move is to treat reversibility as a first-class attribute of every action the agent can take, computed before the action fires. Actions that are reversible flow freely; actions that are irreversible are the ones that earn a gate. This single classification is the backbone of proportionate containment.

Anatomy of an Action Hijack

An action hijack is the conversion of the agent's activity into an attacker-chosen, high-consequence effect. Whatever the entry technique — a bent grounding, an injected instruction in perceived content, a hostile element — the damage is realized only when the resulting action reaches a consequential control. So the attacker's real objective at the act stage is not merely to cause a wrong action but to cause a wrong action that is irreversible and reachable, because that is what converts a slip into an incident.

Three conditions make this possible, and they are the attacker's sub-goals. First, a sensitive control must be reachable in the current context — a send, pay, delete, or authorize that the session can touch. Second, the agent's session must carry standing privilege that gives the action weight — credentials, an authenticated session, or permissions that make the effect real. Third, the action must complete before human oversight intervenes, which the agent's speed and autonomy tend to grant. Deny any one of these and the hijack loses its payoff.

This framing is useful because it tells a defender exactly what to remove. You do not have to prevent every wrong action to prevent the harmful ones; you have to ensure that wrong actions cannot simultaneously be irreversible, privileged, and unsupervised. The containment controls later in this piece each attack one of those three conditions.

Blast-Radius Amplifiers

Four factors amplify the blast radius of any single action, and naming them turns containment into a checklist. Standing privilege is the first: the more the agent's session can reach — authenticated accounts, elevated permissions, connected systems — the more any action can do. Reachability is the second: how close a high-consequence control is to the agent's current context, since an irreversible action one click away is far more dangerous than one buried behind several steps.

Chaining is the third amplifier: when one action unlocks the next, a single hijack can set off a sequence — open an application, retrieve a credential, use it elsewhere — so the effective blast radius is not one action but the cascade it initiates. Autonomy and speed are the fourth: an agent acts far faster than a human reviews, so many actions, including irreversible ones, can complete in the window before anyone notices, giving a hijack a decisive head start.

These amplifiers multiply rather than add. A session with high standing privilege, sensitive controls one click away, actions that chain, and no oversight in the loop can convert a single manipulation into broad, fast, irreversible damage. Containment works by attacking each amplifier: reduce privilege, increase the distance to sensitive controls, break chains, and insert oversight that slows irreversible actions to human speed.

The Autonomy Problem: Speed Outruns Oversight

The autonomy amplifier deserves its own treatment because it is the one most often left unaddressed. The value proposition of an agent is that it acts without waiting for a human, but that same property means a hijacked agent also acts without waiting for a human. In the interval between a manipulation and its discovery, an autonomous agent can execute a long sequence of actions, and if irreversible actions sit in that sequence, they complete before anyone can intervene.

This inverts the usual assumption that a human is a backstop. A human is only a backstop if they are in the loop before the irreversible action, not after it, because after it there is nothing to stop. The defense is therefore not general monitoring — which discovers harm too late — but a gate placed specifically before irreversible actions, so that the agent's speed is throttled exactly and only where speed causes lasting damage.

Circuit breakers complement the gate. A sudden burst of consequential actions, an unusual rate, or a pattern that does not match the task are signals that something has gone wrong, and halting the agent on those signals limits how far a hijack propagates before a human looks. The goal is to make the agent fast where speed is safe and slow where speed is dangerous.

Containing the Blast: Reversibility and Gates

Containment assembles the individual controls into a proportionate system. The foundation is a least-privilege session that shrinks the reachable action space, so the worst case is small before any other control acts. On top of that sits an action-type allow-list that permits only the categories the task needs, turning 'click anything' into 'click these kinds of things'. Then the reversibility classification routes each action: reversible actions proceed, and irreversible ones are gated behind confirmation, a human decision, or a reversible substitute.

Reversibility by design is the most powerful lever because it changes the worst case rather than trying to prevent it. Preferring drafts over sends, staging over committing, dry-runs over live execution, and undoable operations over destructive ones means that even a hijacked action lands somewhere recoverable. Where the platform offers no reversible path, the action is exactly the one that most deserves a human gate.

The decision an agent runtime should make before every action is simple to state: if the action is irreversible, gate it; if it is reversible and of an allowed type, proceed; otherwise block. That single rule, applied consistently, denies a hijack the combination it needs — an irreversible, privileged, unsupervised effect — while leaving the agent free to do the large volume of reversible work that carries no lasting risk.

What This Means for the AI-Agent Stack

The blast-radius view names precisely what the OWASP Agentic guidance calls excessive agency: the risk is not that an agent acts, but that it can act with more reach and less reversibility than any task requires. A computer-use agent is the extreme case, because it discards the schema that bounds a tool-calling agent and acts over open-ended software, so excessive agency is its default state unless deliberately constrained. Securing it is therefore mostly a matter of subtraction — removing privilege, reach, chaining, and unsupervised speed until the worst case is tolerable.

The portable design stance for any screen-driven agent is to treat reversibility and reach as the primary security parameters, ahead of the model's behavior. Assume a hijack will occasionally succeed; ensure it cannot be irreversible, privileged, and unsupervised at the same time; and make the reversible path the default so that most of the agent's work carries no lasting risk. This does not make the agent safe in an absolute sense, but it makes its failures survivable.

The single idea to carry is that a computer-use agent's danger lives in the intersection of an unbounded action space and irreversibility, and containment is the discipline of ensuring no single action can be unbounded and irreversible at once.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

session: least_privilege                 # shrink reachable set
allowed_action_types: [navigate, read, type_draft]
irreversible: [send, pay, authorize, delete, grant]
rule:
  if action.type in irreversible: require_gate  # human or reversible sub
  elif action.type in allowed_action_types: proceed
  else: block
rate_limit: consequential_actions per window
circuit_breaker: halt on burst OR task_mismatch

# DEFENSIVE circuit breaker over the action stream.
window = recent_actions(now, WINDOW)
if count(window, is_consequential) > BURST_LIMIT:
    halt('consequential-action burst')
if not consistent_with(window, current_task):
    halt('task-inconsistent actions')
if action.is_irreversible:
    require_gate()          # slow to human speed only where it matters

Glossary

Blast radius

The scope of consequences a single agent action can cause across reachable software and data.

Action space

The set of effects an agent can produce; for a computer-use agent, the union of what all reachable software exposes.

Reversibility

Whether an action can be undone, ranging from freely reversible to costly-reversible to irreversible.

Action hijack

Converting the agent's activity into an attacker-chosen, high-consequence effect at the act stage.

Standing privilege

Credentials, sessions, or permissions the agent holds that give its actions real-world weight.

Circuit breaker

A control that halts the agent on anomalous action bursts or task-inconsistent behavior to limit propagation.

References

1. Xie, Zhang, Chen et al., OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments (arXiv 2404.07972, NeurIPS 2024)
2. Zhou, Xu, Zhu et al., WebArena: A Realistic Web Environment for Building Autonomous Agents (arXiv 2307.13854, ICLR 2024)
3. Greshake, Abdelnabi, Mishra et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173, 2023)
4. Zhang, Yu & Yang, Attacking Vision-Language Computer Agents via Pop-ups (arXiv 2411.02391, ACL 2025)
5. OWASP Top 10 for LLM Applications
6. OWASP Agentic Security Initiative
7. MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
8. NIST AI Risk Management Framework (AI RMF 1.0)