A single doctored image can apparently make an AI agent open a terminal and run commands you never asked for.
Researchers built an evaluation framework called AgentHijack to test whether a small visual patch, embedded in a webpage, can hijack "computer-use agents" - AI systems that look at a screenshot and decide what to click or type. They planted the patches on pages they controlled, including GitHub Pages sites and a self-hosted clone of the Chinese developer forum CSDN, then let five open-source or publicly available vision-language-model-based agents browse to them. Across 600 individual test runs, the tainted image triggered the intended malicious action 84.5% of the time, correctly matched the attacker's exact command about 47% of the time, and made it all the way through to a verified real-world effect in 20.3% of cases. In several successful runs, the agent ran the injected terminal command first, then went right back to finishing the legitimate task it had been given.
The gap between an 84.5% initial trigger rate and a 20.3% full compromise rate is the real story: these agents have enough friction in their pipeline to blunt most attacks, but not enough to stop one in five. That matters because computer-use agents are being pitched as the next step for AI assistants - systems that browse, click, and type on a real desktop rather than just answering questions in a chat window. An attack surface that is just a pixel pattern on a webpage, with no phishing link or malware download required, is a very different threat model than what most security teams are used to defending against.
The paper is a lab demonstration, not a live incident, but it is a useful reminder that giving an AI model the keys to your screen also means giving it your browser's least trustworthy visitors.