Research map / Multi-agent systems and games / LLM agents

Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agents

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Software engineering agent benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces PhoneSafety, a 700-case benchmark of safety-critical decision points from real Android phone trajectories, classifying each model action as safe, unsafe, or no useful action (CFR), and evaluates eight phone-use agents.

Problem

Harmless outcomes of phone-use agents are ambiguous: they may reflect safe choice or simple inability to act (failure to understand the screen or execute a relevant action), and existing task- or episode-level safety evaluations merge these.

Approach

Evaluate the next action at safety-critical moments with a three-way outcome (safe action, unsafe action, failure to do anything useful), treating the third outcome (CFR) as a capability-oriented signal distinct from safety, and checking its stability under protocol changes.

Key results

• Gemini 3.1 Pro, Seed 2.0 Pro and Claude Opus 4.6 achieve the highest safe-action rates (69.3%, 66.3%, 67.0%) with CFR 15.9-18.4%.
• General phone-use score vs. safe-action rate is only moderately correlated (Spearman rho=0.515), while general score vs. 1-CFR is strongly correlated (Spearman rho=0.922).
• AutoGLM 9B has an unsafe rate of only 13.9% but a CFR of 62.1%, so its low unsafe rate reflects inability to act rather than safety.

Surprising findings

• Low unsafe-action rate for AutoGLM 9B (13.9%) coexists with 62.1% capability failure, so low harm can reflect inability rather than safety.
• Stronger general phone-use ability does not reliably predict safer choices at risky moments (e.g., MobileAgent 3.5 ranks fourth on general tasks but sixth on safe-action rate).

Limitations

• Offline decision-point evaluation that does not measure long-horizon or online behavior or adaptive attacks.
• Restricted to a Chinese Android app ecosystem.
• Protocol ablation uses an auxiliary rule-based relabeling with a simplified classifier rather than re-running models.

Experimental setup

Datasets: PhoneSafety (700 safety-critical moments from 4,512 real Android trajectories) general phone-use evaluation set (7,168 steps, 304 episodes)

Benchmarks: PhoneSafety general phone-use evaluation set

Metrics: safe-action rate unsafe-action rate capability-failure rate (CFR) 1-CFR Spearman correlation Pearson correlation

Baselines: Gemini 3.1 Pro Seed 2.0 Pro Claude Opus 4.6 Kimi 2.5 MobileAgent 3.5 MAI-UI 8B GELab-Zero 4B AutoGLM 9B

Builds on: MobileSafetyBench GhostEI-Bench RiOSWorld GUIGuard

Closest papers by meaning

• MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control (AAAI 2026 · similarity 0.87)
• DIBench: Benchmarking Decision Integrity of GUI-based Mobile Agents Under Deceptive Injections (NeurIPS 2026 · similarity 0.86)
• When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents (ICML 2026 · similarity 0.86)
• OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents (NeurIPS 2025 · similarity 0.85)
• Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness (ICLR 2026 · similarity 0.85)
• Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents (NeurIPS 2026 · similarity 0.84)