
PhD Student @osunlp | Prev: BS/MS @USTC, intern @Apple @nlp_usc @MSFTResearch
Columbus, OH
Joined August 2023
- Tweets129
- Following378
- Followers252
- Likes811
Pinned Tweet
🤖 Agents increasingly rely on skills to handle complex tasks with privileged trust, which makes a poisoned skill a dangerous attack surface. Worse, skills persist and get reused: one can look benign today, silently mutate itself, and attack tomorrow ⚠️
Introducing SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction
• 2 attack scenarios across the skill-use lifecycle: Fixed-Payload Poisoning & Self-Mutating Poisoning
• 12 risks organized by the workflow component harmed: Data Pipeline, System Environment & Agent Autonomy Exploitation
• AutoSkillHarm: automatic attack construction with coding agents driven by natural-language harnesses
🚨 Frontier coding agents stay vulnerable with ASR up to 86.3% and current defenses don't hold.
🔥 Already 3.7K+ downloads on Hugging Face in the first week!
🧵:
Yuting Ning retweeted
1/ Can RL improve accuracy without losing different correct ways to solve a problem?
We tackle this in our new paper EliteReplay, and study diversity at the level of correct solution strategies (not just pass@k 🤓!)
📜: arxiv.org/abs/2610.22290
Thread below 🧵!
Will be at #COLM2026 in SF next week (Oct 6-9) 🌁
Lately, I have been exploring agent safety, computer-use and personal agents. Would love to connect and chat about anything! DM me if you are around!
Yuting Ning retweeted
Another proud moment for our team @osunlp! Glad to see our RedTeamCUA was used by @XLangNLP and @Alibaba_Qwen for evaluation in their recent Qwen-CUA release!
RedTeamCUA (led by @LiaoZeyi and @Jaylen_JonesNLP) evaluates a computer-use agent’s (CUA) robustness against indirect prompt injections in hybrid Web–OS workflows and advocates jointly reporting attack success rate (ASR) and benign task success under attack. Congrats to the Qwen-CUA team on achieving strong results on both metrics - this is an encouraging step in the right direction! Looking forward to seeing more frontier CUAs report both metrics going forward.
In addition, when there is no prompt injection and everything is benign, can things still go wrong? Think about the recent OpenAI-HuggingFace incident! Can we proactively discover those unsafe unintended behaviors at scale before deployment?? Our group recently developed AutoElicit (led by @Jaylen_JonesNLP and @Zhehao_Zhang123) to advance this goal: arxiv.org/abs/2602.08235, an agentic framework that iteratively perturbs benign instructions using CUA execution feedback to elicit severe harms, while keeping those perturbations realistic and benign. It can be used to track how safety evolves as capability increases.
RedTeamCUA:
Website: osu-nlp-group.github.io/RedT…
Paper: arxiv.org/abs/2505.21936
When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents
Website: osu-nlp-group.github.io/Auto…
Paper: arxiv.org/abs/2602.08235
💻 Meet Qwen-CUA — our native computer-use agent for (almost) everything.
Code, APIs, and computer use are three of the most important interfaces for agents. Today’s models are already highly capable with the first two. Qwen-CUA is built to unlock the third: graphical interfaces designed for people.
👀 Native Perception — screenshots only. No DOM, accessibility tree, or other hidden machine-readable state.
🖱️ Native Interaction — keyboard and mouse events across browsers, desktop apps, and professional software. No task-specific APIs.
🧠 Native Intelligence — maintains long-horizon visual context, verifies progress, and learns from large-scale interactive experience with verifiable outcomes.
To make native computer use trainable at scale, we built approximately 40K verifiable tasks and rollout infrastructure with nearly 100K vCPUs, supporting tens of thousands of concurrent environments.
Across eight computer-use benchmarks spanning everyday desktop use, long-horizon workflows, personalized computing, scientific research, web interaction, macOS, and adversarial robustness, Qwen-CUA demonstrates strong and broadly competitive capabilities. Scaling the same recipe to Qwen-CUA-Max pushes this frontier further.
Not just “clicking the screen” — native computer use unlocks software and workflows that previously required a human at the keyboard. Together with code and APIs, it completes the interface stack for more general agents.
Joint work by Qwen Team × XLang Lab.
📖 Technical Report:
github.com/xlang-ai/Qwen-CUA…
💻 Code:
github.com/xlang-ai/Qwen-CUA
Yuting Ning retweeted
🚨 Excited to see our work RedTeamCUA (ICLR ’26 Oral) adopted by @XLangNLP as an adversarial robustness benchmark for their new Qwen-CUA release!
Their evaluation also highlights one of the main motivations behind RedTeamCUA: As frontier computer-use agents become more capable, it is essential to measure both capability and security prior to real-world deployment.
Why?
Evaluating capability alone can obscure growing security risks. In RedTeamCUA, CUAs would often attempt adversarial goals but fail due to lacking the capability to complete the goal, not due to true adversarial robustness. This presents a dangerous scenario: capability improvements alone can amplify existing vulnerabilities if defenses do not improve alongside them. xitter.cf/hhsun1/status/20216963…
Evaluating security alone can be misleading. The most secure agent is also the agent that is the least capable - a lower ASR may represent an agent that is incapable rather than robust to adversarial attack which limits practical usage in the real-world.
RedTeamCUA is designed to enable realistic yet controlled evaluation of both security and capability by featuring:
- A hybrid adversarial testing sandbox combining Docker-based web replicas with a VM-based OS to test web→OS adversarial attack scenarios.
- RTC-Bench, 864 adversarial examples pairing benign web tasks with web-based adversarial injections targeting adversarial goals resulting in fundamental security violations on the user’s OS.
Qwen-CUA shows an encouraging result - using RedTeamCUA, Qwen-CUA demonstrates notable gains on both capability AND security compared to Qwen 3.7:
📈 Task Success: 70.5% → 74.0%
🛡️ Attack Success Rate: 36.6% → 16.4%
Congrats to the Qwen-CUA team on this great result! We hope future frontier CUA releases continue to report capability + adversarial robustness side-by-side.
For more details, check out our work led by @osunlp (@LiaoZeyi, myself, @yuting_ning, @hhsun1, @ysu_nlp) alongside Linxi Jiang, @EricFos, and @cszlin:
🔗 Website: osu-nlp-group.github.io/RedT…
📄 Paper: arxiv.org/abs/2505.21936
💻 Code: github.com/OSU-NLP-Group/Red…
💻 Meet Qwen-CUA — our native computer-use agent for (almost) everything.
Code, APIs, and computer use are three of the most important interfaces for agents. Today’s models are already highly capable with the first two. Qwen-CUA is built to unlock the third: graphical interfaces designed for people.
👀 Native Perception — screenshots only. No DOM, accessibility tree, or other hidden machine-readable state.
🖱️ Native Interaction — keyboard and mouse events across browsers, desktop apps, and professional software. No task-specific APIs.
🧠 Native Intelligence — maintains long-horizon visual context, verifies progress, and learns from large-scale interactive experience with verifiable outcomes.
To make native computer use trainable at scale, we built approximately 40K verifiable tasks and rollout infrastructure with nearly 100K vCPUs, supporting tens of thousands of concurrent environments.
Across eight computer-use benchmarks spanning everyday desktop use, long-horizon workflows, personalized computing, scientific research, web interaction, macOS, and adversarial robustness, Qwen-CUA demonstrates strong and broadly competitive capabilities. Scaling the same recipe to Qwen-CUA-Max pushes this frontier further.
Not just “clicking the screen” — native computer use unlocks software and workflows that previously required a human at the keyboard. Together with code and APIs, it completes the interface stack for more general agents.
Joint work by Qwen Team × XLang Lab.
📖 Technical Report:
github.com/xlang-ai/Qwen-CUA…
💻 Code:
github.com/xlang-ai/Qwen-CUA
Yuting Ning retweeted
Also look for @Jaylen_JonesNLP to chat more
Happening now #ICML2026 poster 3908: Detecting and correcting misaligned actions in agents!
Yuting Ning retweeted
Happening now #ICML2026 poster 3908: Detecting and correcting misaligned actions in agents!
I’ll be in Seoul next week from July 6-12 to present two main conference papers at #ICML2026!
When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents
📍Location: Wed, July 8th • 10:30 - 12:15 KST • Hall A Poster #3908
📄Paper: arxiv.org/abs/2602.08995
🌐Website: osu-nlp-group.github.io/Misa…
🧵Thread: xitter.cf/yuting_ning/status/202…
When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents
📍Location: Thu, July 9th • 10:30 - 12:15 KST • Hall A Poster #3102
📄Paper: arxiv.org/abs/2602.08235
🌐Website: osu-nlp-group.github.io/Auto…
🧵Thread: xitter.cf/Jaylen_JonesNLP/status…
Feel free to reach out if you’re interested in chatting about agent safety, security, and reliability!
Yuting Ning retweeted
100% agree with @demishassabis: "there's two main worries. ... the second worry is a more technical risk, which is as these AI systems get more powerful, more autonomous, maybe entering the agentic era, how do we make sure we can build robust enough guardrails to keep them doing what we want them to do."
When does an AI agent deviate from what we want them to do and cause harm? How to detect and correct misaligned actions to avoid consequences and ensure the agent stay on track?
At #ICML2026 happening this week, my student @Jaylen_JonesNLP and I are going to discuss our recent work and thoughts for addressing these questions:
[1] “When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents”: Thu, Jul 9, 2026, 10:30 AM – 12:15 PM KST, Hall A Poster #3102, led by @Jaylen_JonesNLP @Zhehao_Zhang123 and in collaboration with @yuting_ning @EricFos, Pierre-Luc St-Charles @LawZero_, @Yoshua_Bengio, @dawnsongtweets, @ysu_nlp.
[2] “When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents”: Wed, Jul 8, 2026, 10:30 AM – 12:15 PM KST, Hall A Poster #3908, led by @yuting_ning and in collaboration with @Jaylen_JonesNLP, @Zhehao_Zhang123, Chentao Ye, Weitong Ruan, Junyi Li, Rahul Gupta @AmazonScience.
To our knowledge, [1] is the first project that systematically studies and proactively surface harmful unintended behaviors of computer-use agents from benign inputs (e.g., an agent accidentally deletes files on your system or makes unauthorized changes). We propose a conceptual framework to define their key characteristics, automatically elicit them and analyze how they arise from benign inputs. Datasets with benign task instructions and frontier agents’ trajectories that exhibit unintended behaviors are released.
Now how do we detect and correct misaligned actions (whether due to adversarial prompting/injection or simply unintended) on the fly at runtime, before these actions are taken? In [2], we make the first effort to define and study runtime misaligned action detection in CUAs, and construct MisActBench, a benchmark of realistic trajectories with human-annotated, action-level alignment labels. We develop DeAction, a practical and universal guardrail that detects misaligned actions before execution and iteratively corrects them through structured feedback.
Stop by our posters or ping us to chat more!
Demis Hassabis, CEO of Google DeepMind, was asked about the real risks of AI. He named two -- and admitted the second one has no fix yet.
"there's two main worries. I think one is bad actors repurposing these technologies for harmful ends. And then the second worry is a more technical risk, which is as these AI systems get more powerful, more autonomous, maybe entering the agentic era, how do we make sure we can build robust enough guardrails to keep them doing what we want them to do."
"And how can we do that? Do we know? I think that's still an open research question. And I think more research needs to be done urgently."
The benefits are real -- drugs, health care, climate. But a Nobel laureate running one of the top labs just said the guardrail problem is unsolved, and the agentic era is arriving anyway.
That gap -- between deploying powerful systems and being able to prove they stay under control -- is the assurance layer. Somebody has to build it before the autonomy scales, not after.
P.S. That is the room at the AI Assurance & Governance Summit -- Oct 1, 2026, Stanford. Frontier labs, regulated industries, insurers, and investors, one day, on how you test, audit, and verify these systems before they ship.
Reserve a seat: trustmodel.ai/summit2026
- Demis Hassabis (@demishassabis), CEO of Google DeepMind, on BBC News
Excited to share that this work has been accepted to ICML 2026! 🎉
In this work, we focus on misaligned actions in computer-use agents, including both externally induced and internally arising misalignments, and introduce MisActBench, an action-level benchmark with human-annotated misalignment labels on realistic CUA trajectories, plus DeAction, a plug-and-play runtime guardrail that catches misaligned actions before they execute and corrects them through structured feedback.
Unfortunately, I won't be able to attend in person, but my amazing collaborator @Jaylen_JonesNLP will present our poster. Please stop by and chat with him!
📅 Wed, Jul 8, 2026
⏰ 10:30 AM to 12:15 PM KST
📍 Hall A, Poster #3908
Computer-use agents (CUAs) are getting really capable. But as their autonomy grows, the stakes of them going off-task get much higher 🚨
They can be misled by malicious injections embedded in websites (e.g., a deceptive Reddit post), accidentally delete your local files, or just wander into irrelevant apps on your laptop. Such misaligned actions can cause real harm or silently derail task progress, and we need to catch them before they take effect.
We present the first systematic study of misaligned action detection in CUAs, with a new benchmark (MisActBench) and a plug-and-play runtime guardrail (DeAction).
🧵(1/n)
Yuting Ning retweeted
🚀 Introducing our latest research: AgentCL: Toward Rigorous Evaluation of Continual Learning in Language Agents
Continual learning for language agents has not yet been clearly defined. How should we evaluate their ability to continually learn from experience and improve themselves on complex, long-horizon tasks?
- Traditional continual learning provides a useful perspective on the plasticity–stability trade-off, but its formulation does not naturally extend to non-parametric learning paradigms today.
- Many recent works on agent memory still focus on retrieval and reasoning over long (static) contexts, rather than on how agents can reuse experience from complex agentic tasks.
Across coding, deep research, and language understanding and reasoning tasks, we show that carefully designed task streams and metrics are essential for understanding continual learning in language agents.
📄 Paper: arxiv.org/abs/2606.02461
🤗 Dataset: huggingface.co/datasets/osun…
I'd also like to share a few thoughts from the past six months of building QUEST that didn’t make it into the paper, but might still be useful to the community.
> Mid-training is surprisingly powerful, especially for smaller models.
In our early experiments, we applied mid-training to smaller models like Qwen3-8B and saw surprisingly large gains (~3pp over pure SFT) with only around 100K tasks.
The effect became weaker as model size increased, but for smaller Deep Research agents, carefully designed mid-training tasks can still go a long way.
How should those tasks be designed? That’s a much longer story. If you’re interested, check out the “Unsuccessful Attempts” section in our paper. Honestly, it’s probably my favorite section in the whole paper.
> For agentic RL, infrastructure matters way more.
This might sound like a cliche in 2026, but I still want to yell it loudly.
We spent almost two months just making our RL pipeline stable. Agentic RL is essentially a giant chain of dependencies. The judge model needs to work. The search and retrieval services need to work. The cache needs to work. And all of them need to keep working for days. A tiny bug in any part of the pipeline can ruin an entire training run.
We end up spending a surprising amount of time designing fallback mechanisms for everything. Not because it’s elegant, but because otherwise your training will randomly die at 3 AM after running for days. The secret isn’t fancy RL tricks. The secret is making sure your pipeline survives when things inevitably break.
> Session-level training is probably the reason we can afford long-horizon training.
Everyone working on Deep Research agents knows the pain: context is expensive. Compared to traditional reasoning tasks or short-horizon agents, long-horizon Deep Research training burns through GPU resources much faster.
For most academic groups, GPUs are still the biggest bottleneck. In QUEST, we use session-level training and limit each training instance to 32K tokens. It’s not the most glamorous idea in the paper, but it helps make large-scale long-horizon training much more practical.
> Cache saved us a ridiculous amount in API spend.
We spent a lot of effort building our caching system. At first, it sounded like an engineering optimization. Later, it became a necessity. Many websites visited during data synthesis show up again during RL training. So as the search tool. Without caching, you’re effectively paying for the same information over and over again.
The funny part is that cache becomes even more valuable when your experiments fail. RL runs crash. Services fail. You restart things. But cached results stay.
One funny observation: the more failed runs you have, the higher your cache hit rate gets. It’s a slightly sad but comforting story: every failed run leaves behind a few more cache entries for the next one. By our final training run, the cache hit rate had reached ~40%, which translated into a significant reduction in API costs.
How painful it was to build. How rewarding it was to finish. We hope you’re as excited to meet QUEST as we are to finally share it.
🚀Excited to announce QUEST today!
Benchmark numbers will fade, but the know-how behind them endures.
With QUEST:
See how we synthesize diverse Deep Research tasks through a unified framework at scale.
See how we train Deep Research agents through three stages: Mid-Training → SFT → RL.
See how our caching system dramatically reduces API costs during training.
See how our context management enables unbounded deep research.
We’ve released everything we can!
🚀Excited to announce QUEST today!
Benchmark numbers will fade, but the know-how behind them endures.
With QUEST:
See how we synthesize diverse Deep Research tasks through a unified framework at scale.
See how we train Deep Research agents through three stages: Mid-Training → SFT → RL.
See how our caching system dramatically reduces API costs during training.
See how our context management enables unbounded deep research.
We’ve released everything we can!
We trained a ~frontier Deep Research Agent on academic budget
> 32 H100s
> 8K synthetic samples
> fully open training infra + recipe (SFT, mid-training, RL)
> models of diff sizes (2B -> 35B) ready to use out of the box
This is yet another demonstration of how the frontier of AI is changing. We have reached a point where open models + a small capable team + a few hundred Ks can produce specialized models with ~frontier capabilities. The future of AI doesn’t have to be held in a chokehold by a handful of closed models.
We've open-sourced everything we've built and learned from this project. Hope it helps the community build more!
📌 Project: osu-nlp-group.github.io/QUES…
📌 Paper: arxiv.org/abs/2605.24218
📌 Code: github.com/OSU-NLP-Group/QUE…
📌 Model Weights and Data: huggingface.co/collections/o…
📌 Demo: huggingface.co/spaces/osunlp…
Amazing effort led by @jianxie_ (our 1st year student!!), Tianhe Lin, Zilu Wang. joint with @hhsun1 and the @osunlp team. thanks @amazon Xiangjun Wang for a gift that covers the compute and fruitful discussion.
We trained a ~frontier Deep Research Agent on academic budget
> 32 H100s
> 8K synthetic samples
> fully open training infra + recipe (SFT, mid-training, RL)
> models of diff sizes (2B -> 35B) ready to use out of the box
This is yet another demonstration of how the frontier of AI is changing. We have reached a point where open models + a small capable team + a few hundred Ks can produce specialized models with ~frontier capabilities. The future of AI doesn’t have to be held in a chokehold by a handful of closed models.
We've open-sourced everything we've built and learned from this project. Hope it helps the community build more!
📌 Project: osu-nlp-group.github.io/QUES…
📌 Paper: arxiv.org/abs/2605.24218
📌 Code: github.com/OSU-NLP-Group/QUE…
📌 Model Weights and Data: huggingface.co/collections/o…
📌 Demo: huggingface.co/spaces/osunlp…
Amazing effort led by @jianxie_ (our 1st year student!!), Tianhe Lin, Zilu Wang. joint with @hhsun1 and the @osunlp team. thanks @amazon Xiangjun Wang for a gift that covers the compute and fruitful discussion.
Yuting Ning retweeted
Excited to introduce SkillHarm! We study lifecycle-aware skill attacks, including self-mutating poison that remain dormant before compromising future executions. Agents can iteratively self-refine to create increasingly effective attacks, while frontier ones remain vulnerable
🤖 Agents increasingly rely on skills to handle complex tasks with privileged trust, which makes a poisoned skill a dangerous attack surface. Worse, skills persist and get reused: one can look benign today, silently mutate itself, and attack tomorrow ⚠️
Introducing SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction
• 2 attack scenarios across the skill-use lifecycle: Fixed-Payload Poisoning & Self-Mutating Poisoning
• 12 risks organized by the workflow component harmed: Data Pipeline, System Environment & Agent Autonomy Exploitation
• AutoSkillHarm: automatic attack construction with coding agents driven by natural-language harnesses
🚨 Frontier coding agents stay vulnerable with ASR up to 86.3% and current defenses don't hold.
🔥 Already 3.7K+ downloads on Hugging Face in the first week!
🧵:
Existing defenses don't hold either 🛡️
We test two widely used skill scanners: even the strongest config catches only 55.6% of FPP / 68.8% of SMP injections.
We also test whether prompt-level warnings help. Appending a defensive system prompt reduces ASR in some configs, but most still stay above 70% ASR.
This highlights the need for defenses that go beyond prompt-level interventions.
Many thanks to my co-lead @Zhehao_Zhang123, all collaborators @lal_yash, @BoyuGouNLP, Junyi Li, Weitong Ruan, Chentao Ye, Rahul Gupta, @Diyi_Yang, and our advisors @ysu_nlp, @hhsun1 🫶
📌 Paper: arxiv.org/abs/2606.02540
📌 Website: osu-nlp-group.github.io/Skil…





















