cua-driver

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required observe step (get_window_state / get_browser_state snapshot) ingests the accessibility tree and text of whatever app window the agent targets, which can contain outsider-authored content such as inbound email, chat messages, or web page text, and an outsider can place that content in the window without the agent selecting a specific item.