{"id":"256331d2-f5dd-4d37-ba7d-25bb160eef79","arxiv_id":"2503.15515","paper_version":1,"verdict":"UNVERDICTED","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A roadmap paper proposes CUPAs, agents that combine browser automation with a user-controlled personal knowledge graph, and lays out three development stages.","lead":"This position paper proposes Computer-Using Personal Agents (CUPAs), which pair a browser-controlling agent with a user-owned personal knowledge graph so the agent can act on personal data under user-set policies. The authors argue this design gives users more control over their data, enables more automated tasks, and lets multiple users' agents coordinate and negotiate.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CUPAs' promised 'better control' depends on policy enforcement being external to the very LLM that browses untrusted sites; without an explicit reference monitor, machine-readable policies are advisory data and prompt injection can leak PKG contents.","rationale":"The reader's weakest_assumption focuses on users' ability to express privacy intentions as machine-readable policies and to manage evolving policies. That is a real usability and semantics concern. My concern is more fundamental and architectural: even assuming perfectly expressive and manageable policies, the paper does not establish that the CUPA's 'controlled access' is enforced rather than merely instructed. Since the agent is a generative model operating on untrusted web content, policies stored in the same PKG are vulnerable to prompt injection and to the agent's own data-emitting actions. The cited ODRL formal semantics and policy engines can help only if they are interposed as a reference monitor between the agent, the PKG, and the outside world; the paper leaves this unspecified. I agree with the reader's broader verdict that this is a vision/roadmap paper with no empirical or formal results, so it remains UNVERDICTED under the Pith semantics. The concern does not change the verdict, but it sharpens what would need to be demonstrated before the central claim could be accepted: a concrete enforcement architecture, not just a policy language. I also credit the paper for explicitly listing accountability, provenance, and user-in-the-loop as open challenges, which shows awareness of difficulty, but it does not resolve the enforcement gap.","tokens_in":7808,"tokens_out":2482,"duration_ms":27793,"concrete_test":"Build a minimal CUPA prototype: an LLM-based agent with read access to a PKG, an ODRL-style policy stating 'the home address may be used for order delivery but must not be disclosed to third parties,' and a browser-automation loop. Have the agent visit a deliberately malicious page containing prompt injection that asks it to send the home address to a remote endpoint. Record whether the address is exfiltrated when (a) the agent alone interprets the policy and (b) a separate trusted reference monitor intercepts every outgoing request and blocks any transmission containing PKG-derived fields not permitted by the policy. If exfiltration succeeds in (a) or is only prevented by an external monitor not described in the paper, the 'better control' claim is unsupported as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that a CUPA with controlled access to a Personal Knowledge Graph gives users better control of personal data than a plain CUA. Control is to be realized by machine-readable policies over the PKG, citing ODRL and policy engines (Section 6, 'Security, Privacy, and Policies'). But the paper never specifies an enforcement boundary. In the proposed architecture, the same LLM-based agent that interacts with untrusted websites also reads the PKG and is responsible for honoring the policies; the policies are just more data in the agent's context. This is a taint/TOCTOU problem: a website visited by the agent can inject instructions that cause the agent to ignore or misapply a policy, and even a perfectly specified policy cannot stop the agent from emitting PKG-derived values through its own generated web requests. Section 7's first roadmap step says to extend CUAs 'such that they use a PKG,' which places the LLM inside the trust boundary. For 'controlled access' to be meaningful, all data reads and all agent-observable actions must pass through an external reference monitor that evaluates policies before any data leaves the repository or any request is sent. The paper gestures at policy engines but does not commit to this architecture; if it does not, the claimed control advantage of CUPAs over direct data sharing collapses. This is not merely a question of whether users can express policies, but whether the expressed policies can be enforced at all.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Computer-Using Personal Agents (CUPAs), defined in Section 1 as a Computer-Using Agent that has controlled access to a structured repository of private information relating to a user, instantiated as a Personal Knowledge Graph (PKG). It motivates the idea with a dinner-planning scenario (Section 2), surveys personal data management, PKGs, and LLM-based agents (Section 3), argues for added value such as multi-dimensional negotiation and auditing (Section 4), lists capabilities (Section 5), outlines technical challenges including security and trust (Section 6), and gives a three-stage roadmap from PKG-enhanced CUAs to networks of CUPAs (Section 7). The paper's central claim is that coupling browser-automating agents with a user-owned PKG and machine-readable policies yields better control, greater automation, better interoperability, and multi-user coordination than plain CUAs.","tokens_in":8095,"tokens_out":7915,"duration_ms":78169,"significance":"If the central architectural claim holds, the paper makes a useful conceptual contribution: it names a class of systems, connects it to existing technologies (Operator, Agent-E, ODRL, Solid/Charlie, FoodKG), and provides a concrete roadmap with intermediate milestones. The paper is clearly framed as a position/roadmap (Section 7), so the absence of empirical evaluation is appropriate. The main strength is that the proposal is specific enough to be falsifiable once an enforcement architecture is specified; one could then test whether policy-controlled PKG access improves user control relative to direct data sharing or takeover-mode CUAs. The main weakness is that the paper does not yet specify that enforcement architecture, and the claimed 'better control' advantage depends on it.","major_comments":[{"comment":"The claim that CUPAs give users 'better control' over personal data is load-bearing (abstract, Section 4), but the paper never specifies an enforcement boundary. In the proposed architecture the same LLM-based agent that browses untrusted websites also reads the PKG and is responsible for honoring policies; the policies are just additional data in the agent's context. As a result, a website visited by the agent can inject instructions that cause the agent to ignore or misapply a policy, and a policy statement cannot by itself prevent the agent from emitting PKG-derived values in its own web requests. For 'controlled access' to be meaningful, the paper should commit to an external reference monitor that evaluates policies before any PKG data is exposed to the agent and before any agent-observable action is performed, and should discuss how prompt-injection resistance is achieved.","section":"Section 6; Section 4"},{"comment":"The first roadmap step says to extend CUAs 'such that they use a PKG in order to access knowledge personal to the user,' which places the LLM inside the trust boundary. This is in tension with the definition's 'controlled access' and with the abstract's control claim. The paper should either specify that in this stage all PKG reads are mediated by a separate policy engine (with the LLM seeing only permitted projections), or justify why the control property is intended to hold in a weaker sense. As written, the roadmap appears to defer the central control mechanism to an unspecified later stage.","section":"Section 7 (first roadmap step)"},{"comment":"The proposal assumes that users can express privacy and delegation intentions as machine-readable policies over the PKG, citing ODRL and policy engines. It does not, however, address how non-expert users will author, review, and update these policies, nor what happens when policies are incomplete, inconsistent, or out of date. Since Section 4 argues that CUPAs reduce cognitive load relative to broad human-level policies, this usability and maintainability question is directly relevant to the 'better control' claim. A roadmap treatment should at least name this as an open problem and point to candidate mechanisms (e.g., policy templates, interactive policy elicitation, policy evolution from user corrections).","section":"Section 4; Section 6 (Security, Privacy, and Policies)"}],"minor_comments":[{"comment":"The text 'invokes atakeover mode' should read 'invokes a takeover mode'.","section":"Section 2"},{"comment":"The sentence 'he requests that his CUPA to generates some suggestions' is ungrammatical; suggest 'his CUPA generate'.","section":"Section 2"},{"comment":"The comparative claims such as 'better control' and 'better interoperability' are stated as facts, but the paper presents no evaluation; consider phrasing them as intended advantages or hypotheses to match the roadmap framing.","section":"Abstract; Section 4"},{"comment":"The relationship between the three 'levels' and the three stages is not explicit; a sentence mapping each stage to the corresponding trust, accountability, and autonomy level would help.","section":"Section 7"},{"comment":"The phrase 'This report is a result of Dagstuhl Seminar 25051' should be 'This report resulted from Dagstuhl Seminar 25051'.","section":"Section 8"}],"recommendation":"major_revision","confidential_remarks":"The paper is a position/roadmap rather than a technical contribution, and it builds on prior proposals (Charlie, Wright, AGENTiGraph) that are cited fairly. The main issue is not novelty but the gap between the 'better control' claim and the missing enforcement architecture; this is fixable by adding a dedicated architecture and security section. The authors should also be encouraged to engage with the prompt-injection and reference-monitor literature when revising. The paper is within scope for a venue that publishes vision papers."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Brief take: this is a position paper from a Dagstuhl seminar, so judge it as agenda, not as a result. It proposes CUPAs—CUAs with controlled access to a user's Personal Knowledge Graph—and lays out a three-stage roadmap. That is a real and useful framing. The paper is honest about its roots: Section 3 explicitly cites Berners-Lee's Charlie and AGENTiGraph as near predecessors, so the novelty is the packaging, the scenario, and the explicit roadmap, not the core idea. Credit where due: the scenario is concrete, the technical challenges list is sensible, and the paper avoids overselling what exists today. It also does not hide that this is a proposal.\n\nThe soft spot is the one the stress-test flags, and it lands. Section 4 and the abstract claim 'better control' of personal data. Section 6 says machine-readable policies (ODRL, policy engines) will provide usage control, but the paper never says where those policies are enforced. The first roadmap step—'extend CUAs such that they use a PKG'—puts the same LLM that browses untrusted sites inside the trust boundary; the policies are just more text in its context. Without an external reference monitor that gates every data read and every outbound action, prompt injection from a visited site can leak PKG contents or cause the agent to ignore a policy. I'm not saying the paper is wrong to propose policies, but 'controlled access' is the entire point of a CUPA, and the enforcement architecture is the load-bearing part. The paper gestures at policy engines but does not commit. That is the difference between a roadmap and a hand-wave.\n\nA secondary, related concern: the paper assumes users can express delegation intent as machine-readable policies that are precise enough to constrain the agent but usable enough not to block automation. That is acknowledged implicitly in Section 6, but it deserves a stated research question rather than an assumption.\n\nWho should read this: anyone working on LLM agents with personal data, especially on privacy-preserving automation. It is a useful reference for the CUPA term and the roadmap. It deserves a serious referee; a good reviewer would push the authors to specify the enforcement boundary and to soften the 'better control' claim in the abstract or make the reference monitor part of the definition. My verdict: engage with it, but treat the control guarantee as an open problem, not a property.","headline":"A coherent Dagstuhl position paper that names a useful architectural direction, but its central promise of 'better control' hinges on an enforcement boundary it never specifies.","tokens_in":8665,"tokens_out":1851,"would_cite":true,"duration_ms":18027,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes Computer-Using Personal Agents: browser-operating agents whose access to a user's personal data is routed through a controlled personal knowledge graph rather than granted directly.","keywords":["Computer-Using Agents","Personal Knowledge Graph","personal data control","privacy policies","ODRL","web automation","multi-agent coordination","agent roadmap"],"falsifier":"A user study in which people encode their own data-sharing preferences in the proposed policy language would settle the question: if participants routinely produce rules that permit a disclosure they later reject or block an action they wanted, the claimed control advantage of CUPAs collapses.","tokens_in":7630,"feed_emoji":"🤖","tokens_out":5377,"duration_ms":49986,"temperature":0.7,"pith_summary":"Computer-using agents (CUAs) can operate browsers on a user's behalf, but they face a dilemma: give them personal data directly and risk misuse, or keep them away from it and limit what they can do. The paper proposes Computer-Using Personal Agents (CUPAs), defined as CUAs with controlled access to a structured repository of the user's private information. It instantiates that repository as a Personal Knowledge Graph (PKG) so that access and usage are governed by machine-readable policies rather than granted wholesale. If the proposal holds, users get finer-grained control over what agents may see and do, agents can automate more tasks that involve personal data, and multiple agents can cooperate on tasks that draw on several users' data.","feed_headline":"Give browser agents a private graph, not the keys to your data","feed_subtitle":"CUPAs route personal data through a knowledge graph with machine-readable policies.","key_machinery":"The load-bearing object is the Personal Knowledge Graph (PKG), a structured, user-side repository of personal data. It carries the argument because it separates data storage from the agent, allowing access to be mediated by formal policy mechanisms such as ODRL and policy engines with formal semantics. The paper also leans on a hybrid communication model—natural language for negotiation followed by structured data for committing to transactions—as the enabler for multi-agent coordination.","core_discovery":"The central claim is the definition offered in Section 1: a Computer-Using Personal Agent is a Computer-Using Agent that has controlled access to a structured repository of private information relating to a user. The paper further proposes to build that repository as a Personal Knowledge Graph, which makes the user's data queryable and integrable while enabling declarative policies over how the agent may use it. The paper argues this configuration is the right middle ground between giving agents no personal data and giving them unfettered access, and it lays out a three-stage roadmap—starting with today's CUAs augmented with a PKG, moving to agents that interact with websites over HTTP rather than through vision models, and finally to networks of cooperating CUPAs.","pith_inferences":["The proposal implies that the main site of privacy governance shifts from websites' cookie banners and consent dialogs to a user-side policy file that travels with the agent; if standardised, this could make consent expressions portable across services.","A testable extension would be a benchmark of realistic user privacy intentions encoded as PKG policies, measuring whether the policy layer permits exactly the intended disclosures and blocks the unintended ones.","The 'discuss then transact' idea suggests that reliability of multi-agent deals may hinge less on making agents fully fluent in natural language and more on having a structured commitment layer underneath the conversation.","If CUPAs become widespread, the value of personal data may shift from companies that aggregate it to the individual, since a single user's PKG can be enriched and reused across many tasks."],"forward_implications":["CUPAs can safely automate form filling and other personal-data tasks that current CUAs push back to the user in take-over mode.","By combining the PKG with external knowledge sources, a CUPA can make context-aware choices, such as filtering recipes by health constraints or substituting unavailable ingredients.","CUPAs representing different users can exchange information and negotiate toward outcomes that respect each user's preferences and policies.","A staged deployment path exists: first augment existing CUAs with a PKG, then teach agents to interact with Web APIs directly, then connect CUPAs into networks."],"supporting_citations":[{"why":"Documents the take-over mode in current CUAs for sensitive data, which motivates the need for controlled access to personal data.","marker":"[25]"},{"why":"Offers a prior brief proposal combining LLM-based agents with personal knowledge graphs in Solid pods, the closest precursor to CUPAs.","marker":"[4]"},{"why":"Provides the long-standing Semantic Web vision of autonomous agents and machine-readable data that this paper updates.","marker":"[5]"},{"why":"Defines the ODRL Information Model, the standard used to express machine-readable policies over personal data.","marker":"[17]"},{"why":"Supplies formal semantics for ODRL, grounding the claim that policies can be automatically processed and enforced.","marker":"[15]"},{"why":"Surveys personal knowledge graphs and lays out a research roadmap, supporting the choice of a PKG as the user's data repository.","marker":"[27]"},{"why":"Describes Agent-E, a research CUA used as the starting point for the first roadmap stage of augmenting CUAs with a PKG.","marker":"[1]"},{"why":"Introduces the 'discuss then transact' model for LLM-based personal agents, which the paper adopts for the final stage of networked CUPAs.","marker":"[31]"}],"fun_headline_variants":["Browser agents get a personal knowledge graph","Personal knowledge graphs keep AI agents on a leash","Give your agent a private graph, not your data","CUPAs: agents with controlled access to your data","From CUAs to CUPAs: data-aware browser automation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The argument assumes that users can express their privacy intentions as machine-readable policies over a personal knowledge graph accurately enough to both permit useful automation and prevent misuse.","fun_headline_variants_meta":{"raw":{"variants":["Browser agents get a personal knowledge graph","Personal knowledge graphs keep AI agents on a leash","Give your agent a private graph, not your data","CUPAs: agents with controlled access to your data","From CUAs to CUPAs: data-aware browser automation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000195,"raw_usage":{"total_tokens":1265,"prompt_tokens":762,"completion_tokens":503,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":378,"completion_tokens_details":{"reasoning_tokens":428}},"tokens_in":378,"tokens_out":503,"duration_ms":5196,"temperature":1.0,"reasoning_tokens":428,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T21:22:17.102532+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A user study in which people encode their own data-sharing preferences in the proposed policy language would settle the question: if participants routinely produce rules that permit a disclosure they later reject or block an action they wanted, the claimed control advantage of CUPAs collapses.","supporting_citations":[{"cited_title":"Introducing Operator","cited_arxiv_id":null,"evidence_quote":"Documents the take-over mode in current CUAs for sensitive data, which motivates the need for controlled access to personal data."},{"cited_title":"Charlie Works","cited_arxiv_id":null,"evidence_quote":"Offers a prior brief proposal combining LLM-based agents with personal knowledge graphs in Solid pods, the closest precursor to CUPAs."},{"cited_title":"The semantic web","cited_arxiv_id":null,"evidence_quote":"Provides the long-standing Semantic Web vision of autonomous agents and machine-readable data that this paper updates."},{"cited_title":"ODRL Information Model 2.2, Feb 2023","cited_arxiv_id":null,"evidence_quote":"Defines the ODRL Information Model, the standard used to express machine-readable policies over personal data."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies formal semantics for ODRL, grounding the claim that policies can be automatically processed and enforced."},{"cited_title":"G., Balog, K., Bernard, N., Łajewska, W., and Linjordet, T","cited_arxiv_id":null,"evidence_quote":"Surveys personal knowledge graphs and lays out a research roadmap, supporting the choice of a PKG as the user's data repository."},{"cited_title":"Here's Charlie! Realising the Semantic Web vision of Agents in the age of LLMs","cited_arxiv_id":"2409.04465","evidence_quote":"Introduces the 'discuss then transact' model for LLM-based personal agents, which the paper adopts for the final stage of networked CUPAs."}],"review_version":1}