arXiv:2605.13631v3 Announce Type: replace Abstract: Computer-use agents are increasingly capable of operating on real operating systems, but this capability has also increased their exposure to prompt injection and other adversarial content that can manipulate their behavior during interaction. Existing defenses typically rely on analyzing the prompt or each potentially malicious input with a second large model at inference time, which can limit coverage or increase deployment cost. We propose ProjGuard, a lightweight runtime monitor that derives a scalar risk signal from the agent's accumulated response history using a supervised linear projection. The monitor evaluates this signal at each step and raises an alert when it exceeds a fitted threshold. When an alert is raised, we selectively activate an auxiliary vision-language model (VLM) to propose the next action and steer execution back toward task completion. Experiments on OS-Harm show that monitoring with on-demand VLM intervention reduces the unsafe rate from 16% to 3% while improving task completion from 59% to 65%. We further evaluate transfer to RiosWorld, where the method remains competitive, reaching 4% unsafe and 64% completion. Overall, these results support a hierarchical safety strategy that combines continuous response monitoring with selective multimodal intervention.