An AI system that grades other AI agents' work just got harder to fool with a screenshot.
A paper posted to arXiv (2609.36201) introduces SCOUT, a two-stage verifier built to catch computer-use agents - AI systems that click, type, and navigate real software - when they cause harm during ordinary, non-malicious tasks. The first stage reasons over the agent's task and trajectory to write a task-specific checklist of what safe, complete execution should look like. The second stage, a "probing agent," then goes back into the post-task environment and actively checks whether those conditions actually hold, rather than trusting the screenshots alone. On the AutoElicit-Bench benchmark, SCOUT scored 75.4 unsafe-detection F1 and 74.5 completion F1; on OS-Blind it hit 76.4% unsafe-detection accuracy. Adding a test-time reflection step cut the rate of unsafe executions slipping through from 30.2% to 17.2%.
The gap SCOUT is targeting is real: a screenshot shows what an agent clicked, not what it actually changed under the hood, so a judge that only looks at pictures can miss a quietly deleted file or an altered setting. As agentic tools get let loose on real desktops and browsers, that blind spot matters more than one more benchmark score suggests.
The paper reports that SCOUT beat screenshot-only and tool-use-only verifier baselines on both benchmarks, but arXiv:2609.36201 does not publish those baselines' own F1 numbers alongside SCOUT's - so treat "outperforms" as the authors' framing until an independent evaluation checks the math.