Jaylen Jones

@Jaylen_JonesNLP

Ph.D. at The Ohio State University | Member of OSU NLP Group (@osunlp) and SLATE Lab

Columbus, OH jjones62202.github.io Joined April 2024

153 Following 147 Followers 97 Posts

Latest posts 5

Pinned post

Jaylen Jones @Jaylen_JonesNLP Jun 9

Excited to share that our paper, "When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents", has been accepted to #ICML2026! Looking forward to presenting in Seoul 🇰🇷

We introduce AutoElicit, an agentic framework that automatically elicits unsafe unintended behaviors from computer-use agents by iteratively perturbing benign instructions using execution feedback.

With AutoElicit, we proactively surface hundreds of severe harms from frontier CUAs within realistic and benign computer-use scenarios to uncover long-tail safety risks.

For the camera-ready version, we added several new experiments and ablations to assess AutoElicit's generalizability, validate the reliability of our findings, and identify the key factors driving elicitation success ⬇️

Jaylen Jones @Jaylen_JonesNLP Aug 12

🚨 Excited to see our work RedTeamCUA (ICLR ’26 Oral) adopted by @XLangNLP as an adversarial robustness benchmark for their new Qwen-CUA release!

Their evaluation also highlights one of the main motivations behind RedTeamCUA: As frontier computer-use agents become more capable, it is essential to measure both capability and security prior to real-world deployment.

Why?

Evaluating capability alone can obscure growing security risks. In RedTeamCUA, CUAs would often attempt adversarial goals but fail due to lacking the capability to complete the goal, not due to true adversarial robustness. This presents a dangerous scenario: capability improvements alone can amplify existing vulnerabilities if defenses do not improve alongside them. x.com/hhsun1/status/…

Evaluating security alone can be misleading. The most secure agent is also the agent that is the least capable - a lower ASR may represent an agent that is incapable rather than robust to adversarial attack which limits practical usage in the real-world.

RedTeamCUA is designed to enable realistic yet controlled evaluation of both security and capability by featuring:

- A hybrid adversarial testing sandbox combining Docker-based web replicas with a VM-based OS to test web→OS adversarial attack scenarios.
- RTC-Bench, 864 adversarial examples pairing benign web tasks with web-based adversarial injections targeting adversarial goals resulting in fundamental security violations on the user’s OS.

Qwen-CUA shows an encouraging result - using RedTeamCUA, Qwen-CUA demonstrates notable gains on both capability AND security compared to Qwen 3.7:

📈 Task Success: 70.5% → 74.0%
🛡️ Attack Success Rate: 36.6% → 16.4%

Congrats to the Qwen-CUA team on this great result! We hope future frontier CUA releases continue to report capability + adversarial robustness side-by-side.

For more details, check out our work led by @osunlp (@LiaoZeyi, myself, @yuting_ning, @hhsun1, @ysu_nlp) alongside Linxi Jiang, @EricFos, and @cszlin:

🔗 Website: osu-nlp-group.github.io/RedTeamCUA/
📄 Paper: arxiv.org/abs/2505.21936
💻 Code: github.com/OSU-NLP-Group/…

Dunjie Lu Verified account @DunjieLu1219 Aug 2

💻 Meet Qwen-CUA — our native computer-use agent for (almost) everything.

Code, APIs, and computer use are three of the most important interfaces for agents. Today’s models are already highly capable with the first two. Qwen-CUA is built to unlock the third: graphical interfaces designed for people.

👀 Native Perception — screenshots only. No DOM, accessibility tree, or other hidden machine-readable state.

🖱️ Native Interaction — keyboard and mouse events across browsers, desktop apps, and professional software. No task-specific APIs.

🧠 Native Intelligence — maintains long-horizon visual context, verifies progress, and learns from large-scale interactive experience with verifiable outcomes.

To make native computer use trainable at scale, we built approximately 40K verifiable tasks and rollout infrastructure with nearly 100K vCPUs, supporting tens of thousands of concurrent environments.

Across eight computer-use benchmarks spanning everyday desktop use, long-horizon workflows, personalized computing, scientific research, web interaction, macOS, and adversarial robustness, Qwen-CUA demonstrates strong and broadly competitive capabilities. Scaling the same recipe to Qwen-CUA-Max pushes this frontier further.

Not just “clicking the screen” — native computer use unlocks software and workflows that previously required a human at the keyboard. Together with code and APIs, it completes the interface stack for more general agents.

Joint work by Qwen Team × XLang Lab.

📖 Technical Report:
github.com/xlang-ai/Qwen-…
💻 Code:
github.com/xlang-ai/Qwen-…

View quoted post on X

Jaylen Jones @Jaylen_JonesNLP Jul 1

I’ll be in Seoul next week from July 6-12 to present two main conference papers at #ICML2026!

When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents
📍Location: Wed, July 8th • 10:30 - 12:15 KST • Hall A Poster #3908
📄Paper: arxiv.org/abs/2602.08995
🌐Website: osu-nlp-group.github.io/Misaligned-Act…
🧵Thread: x.com/yuting_ning/st…

When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents
📍Location: Thu, July 9th • 10:30 - 12:15 KST • Hall A Poster #3102
📄Paper: arxiv.org/abs/2602.08235
🌐Website: osu-nlp-group.github.io/AutoElicit/
🧵Thread: x.com/Jaylen_JonesNL…

Feel free to reach out if you’re interested in chatting about agent safety, security, and reliability!

arxiv.org When Actions Go Off-Task: Detecting and Correcting Misaligned... Computer-use agents (CUAs) have made tremendous progress in the past year, yet they still frequently produce misaligned actions that deviate from the user's original intent. Such misaligned...

Jaylen Jones @Jaylen_JonesNLP Feb 17

⚠️Unintended behaviors of computer-use agents (CUAs) are severe, long-tail harms emerging from benign inputs that deviate from what a user actually wants for a task.

Spoiler: Even the newly released SoTA Claude Opus 4.6 is vulnerable to unintended behaviors under benign input.

Why does this happen?

Despite its simplicity, natural language is an imperfect form of communication. Instructions are often underspecified, messy, and full of implicit expectations and constraints, yet CUAs must be able to adhere to user intent to avoid severe, potentially irreversible harms.

Problem: These safety risks only rarely occur from naturally occurring user inputs, making them difficult to capture from realistic scenarios but essential to proactively evaluate.

To address this, we introduce:

• A conceptual framework defining unintended behaviors as unsafe agent actions that diverge from user intent, emerging inadvertently from benign input contexts without adversarial manipulation

• AutoElicit, an agentic framework that iteratively perturbs realistic OSWorld tasks using execution feedback and quality rubrics, enabling proactive and scalable discovery of long-tail safety risks from benign inputs.

• Large-scale experiments revealing hundreds of unintended behaviors across frontier CUAs and analysis of the vulnerabilities allowing them to occur

View quoted post on X

Jaylen Jones @Jaylen_JonesNLP Apr 27

At #ICLR2026, many highlighted the gap between agent performance in evaluations and the reliability needed for real-world deployment readiness.

Incidents like this show that gap playing out in practice.

Our recent study provides AutoElicit as an automatic method to proactively surface and analyze such unintended behaviors before they reach production systems. We find that computer-use agents don't always adhere to core safety principles, leading to severe consequences as a result.

Reliability for computer-use agents isn't optional - it's essential for trustworthy deployment.

JER Verified account @lifeofjer Apr 25

x.com/i/article/2048…
View quoted post on X

Jaylen Jones @Jaylen_JonesNLP Apr 16

Excited to share that I’ll be heading to #ICLR2026 in Rio 🇧🇷!

I’ll be presenting two papers related to evaluating risks in computer-use agents (CUAs), centered on:

Agent Security (RedTeamCUA, Main Conference Oral):
We introduce a framework for realistic, controlled adversarial testing of CUAs with a hybrid Web-OS sandbox, revealing consistent vulnerabilities in frontier CUAs to indirect prompt injection across Web-OS attack pathways.

Agent Safety (AutoElicit, AIWILD Workshop Spotlight):
We develop the first agentic framework for automatically eliciting unintended behaviors from realistic CUA contexts, proactively surfacing unsafe behaviors that emerge inadvertently from benign inputs.

As agents become more capable, rigorously evaluating both security and safety risks is essential for real-world deployment.

Looking forward to sharing and discussing in Rio - more details below 👇