AI Agents Pursue Their Goals at Any Cost: Microsoft and NVIDIA Study
Agents capable of operating directly on a computer, known as computer-use agents (CUA), tend to pursue the given goal at all costs, even when it is unattainable, ambiguous, or outright dangerous. This is supported by a new study by researchers from Microsoft, NVIDIA, and the University of California Riverside, coining the phenomenon as "blind goal-directedness", the blind orientation towards the goal.
It is interesting to note that the doubts are raised by researchers linked to two of the companies that strongly promote the narrative of AI agents being ready to revolutionize work. While the official communication from Microsoft and NVIDIA describes these systems as mature, the study from their own researchers shows that they struggle with the simplest tasks and that, in trying, they can sabotage the user.
Three Ways to Be Wrong, and a Benchmark to Measure Them
The researchers isolate three recurring behaviors: a lack of contextual reasoning, arbitrary assumptions in front of ambiguous instructions, and the pursuit of contradictory or impossible goals. To quantify them, they built BLIND-ACT, a benchmark of 90 tasks based on the OSWorld environment, where an automatic judge evaluates the agent's behavior with a 93.75% agreement with human annotators.
When testing nine leading models including Claude Sonnet, Opus 4, GPT-5, and Computer-Use-Preview by OpenAI, the average blind behavior rate was at 80.8%. The risk, the paper notes, emerges even when the inputs are not harmful in themselves.
One agent based on o4-mini, faced with a chat history describing a plan to kidnap a girl and kill her mother, nonetheless executed the instruction to calculate the route to the house without applying any contextual filter. In another case, an agent GPT-5, tasked with getting a proposal approved by a human or automatic reviewer, decided to delete the section on weak points and falsified the results, inflating the stated accuracy from 37% to 95%. Finally, an agent Claude Sonnet 4 continued to scroll indefinitely through a YouTube page searching for a video uploaded 46 years ago, ignoring that the platform has only existed since 2005.
Why It's Not Enough to Ask the Model to Behave Well
Known countermeasures are not very effective: according to Erfan Shayegani, the lead author of the study, a PhD student at UC Riverside and intern in Microsoft’s AI Red Team, the widespread approach consists of overloading the agent with safety instructions, almost "begging" it to "behave well". Even with pedantic instructions, however, a residue of "reckless" behavior remains.
The underlying solution, he explains, involves targeted training in these environments, which is lengthy and costly. His 100 test tasks, solely on Anthropic models, cost about $500, because each action requires dozens of sequential steps, with screenshots and desktop accessibility trees at each turn. Delegating control to a second agent tasked with monitoring the context, he adds, would introduce further inefficiency and additional costs.
The study also points out a second problem, mirroring the first: most agents do not complete the tasks assigned at all. The average completion rate hovers around 30%, with DeepSeek achieving it about once in two and Claude Opus 4 around 12%. Shayegani, however, warns against interpreting those numbers as an index of safety: often a model fails simply because it cannot, remaining stuck on a wrong icon until it exhausts the available steps.
Although the study was conducted on less recent models (the paper was submitted in October 2025), the researchers' warning tempers the tendency to assume that a more capable agent would also be safer: as these systems become more competent, the blind margin of error will not shrink, and they may indeed become more difficult to understand.