CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environments
Yuxuan Li, Will Epperson, Wesley Deng, Zezhou Huang
cs.AI · cs.CL
Quick verdict
Benchmark: marketplace steering drops CUA optimal purchases 78.6%→17.3%; sound matched-control design, but no stated code release and tiny Hard split.
Summary
The paper introduces CAVEAT, a benchmark of nine simulated browser-based marketplaces designed to test whether computer-use agents preserve the user's objective when the platform itself has commercial incentives — a regime the authors call incentive-misaligned environments, distinct from adversarial prompt-injection settings. A taxonomy of eight steering mechanisms (sponsored placement, preferential ranking, drip pricing, promotional framing, defaults/bundling, scarcity cues, trust signals, friction) is operationalized from regulatory literature. Tasks are programmatically validated to have a unique user-optimal product; matched-control comparisons hold requests, catalogs, and optima fixed while toggling mechanisms. Across five model families (18 configurations, three repetitions per 52 Standard tasks), optimal purchase falls from 78.6% in the control to 17.3% under steering; on five Hard tasks with 2,112 products, GPT-5.6-Sol-high drops from 90.0% to 0.0%. Trajectory analysis and targeted ablations (preference-order reversal, product-placement intervention, drip-pricing isolation) attribute failures to objective drift, premature search closure, and commitment with unresolved evidence. CAVEAT-Harness — a pinned structured objective plus a pre-purchase verification tool — raises GPT-5.6-Terra from 11.7% to 66.7% on Shop (at 2.6× runtime), and post-trained CAVEAT-27B reaches 22.9% versus 4.2% for its backbone. Limitations: no stated code/data release, small Hard and transfer splits, and limited per-mechanism attribution.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Activating eight realistic marketplace steering mechanisms drops optimal purchase rate from 78.6% to 17.3% across five model families under matched decision problems (52 Standard tasks, three repetitions).
- Incentive-induced failures concentrate at three identifiable loci: objective drift, premature search closure, and commitment with unresolved evidence.
- CAVEAT-Harness — a pinned structured objective plus a pre-purchase verification tool — recovers most of the degradation (11.7%→66.7% on Shop; 0.0%→80.0% on Hard) at 2.6× baseline runtime.
- Two-stage targeted post-training lets a 27B open model execute the harness decision procedure, improving from 4.2% to 22.9% on held-out product types.
Strengths
Matched-control design gives clean causal attribution
Sections 2-3 hold request, catalog, product facts, and the unique user-optimal product fixed while toggling the eight mechanism families on/off, so the 78.6%→17.3% gap (Fig. 3A) isolates choice architecture rather than task difficulty — a methodological step above most agent benchmarks.
Diagnosis backed by targeted ablations, not just anecdotes
Section 5 moves from a blind 200-trajectory review to quantitative tests: preference-order reversal flips all 25/25 matched pairs; a placement intervention raises a suboptimal product's visit rate 45/60→60/60 but purchase 0/60→48/60; drip-pricing alone causes 35/60 suboptimal purchases, all to the drip-priced promoted product.
Regulation-grounded, verifiable task construction
Honest cost accounting and component ablation of the fix
Cross-harness corroboration
Weaknesses
No stated code or data release
Headline extremes rest on tiny splits
All eight mechanisms co-activated in the main condition
Statistical reporting thin outside Figure 3
CAVEAT-27B transfer is within-environment
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
CAVEAT: Peer Review — Incentive Misalignment for Computer-Use Agents
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the CAVEAT benchmark?
CAVEAT is a benchmark of nine simulated online marketplace websites (retail, lodging, food delivery, resale, freelance, grocery, specialty) used to test whether computer-use agents — AI agents that browse and purchase on a user's behalf — still buy the product that is best for the user when the platform's own commercial incentives point elsewhere. Each task has exactly one verifiably optimal product, and the same task is run with eight steering mechanisms off (matched control) and on (incentive-misaligned).
How much do marketplace incentives hurt AI shopping agents?
Across five model families and 18 configurations on 52 standard tasks, agents bought the user-optimal product in 78.6% of episodes with steering off but only 17.3% with all eight mechanisms on — a 61.3-point drop. On a 2,112-product catalog, the strongest tested configuration fell from 90.0% to 0.0% across 50 episodes.
What is an incentive-misaligned environment?
It is an environment that functions as designed — no attacks, no false information — but whose owner profits from outcomes that may conflict with the user's objective, such as a marketplace promoting higher-margin products via sponsored placement or drip pricing. CAVEAT distinguishes this from adversarial settings (prompt injection, malicious content) where an attacker deliberately compromises the agent.
What is CAVEAT-Harness and how much does it help?
It is an inference-time scaffold with two parts: the agent first writes a fixed structured specification of the user's stated requirements, and an optional verification tool forces a search-completeness and evidence check before purchase. It raised GPT-5.6-Terra from 11.7% to 66.7% optimal purchases on CAVEAT-Shop (prompting alone reached 30.0%) and GPT-5.6-Sol-high from 0.0% to 80.0% on CAVEAT-Hard, at about 2.6 times the baseline runtime.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are available only as extracted captions/numbers; visual elements (error-bar magnitudes, distributions) were not independently verifiable.
- Appendix content is absent from the extraction — post-training hyperparameters, task templates, and environment screenshots could not be assessed.
- No code/data release statement appears in the extracted text; a release may exist in a supplementary link not captured by extraction.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.