Give a computer-use agent an explicit refusal tool or attack success jumps 21 to 23 points.

ADeptS-Bench tests seven models on paired benign and malicious GUI tasks and finds none clearing 80% task success while staying under 30% attack success. The ablation is the usable finding: removing the refusal tool raises attack success 21-23pp for tool-dependent models and 10-11pp for partially tool-dependent ones, while models with no refusal mechanism don't change. Safety here lives in the harness affordance, not the weights. (arXiv 2608.26204) Every model tested clicked Checkout on a $25K order, and none caught a factory-reset button mislabeled Optimize.