Doppelganger Screens — Development skill for Claude Code

Doppelganger Screens

The laboratory behind the paper **Doppelganger Screens: Indistinguishable Authority Spoofing Against Computer Use Agents** (Christian David Varela, Psypher Labs, 2026): the harness, the experiments, every recorded episode the paper reads, and the scripts that rebuild the paper from those records.

The experiment

A computer-use agent sees a screen and acts on it. An authority prompt on that screen — a sign-in form, a permission dialog, a confirmation, an update notice — can be drawn by the application that owns the screen or by content inside it: a web page, a chat message, an email. When the two renderings are pixel-identical nothing in a screenshot tells them apart. The paper measures what three agents do with such a copy: two open-weight models run locally (Qwen3-VL 8B, UI-TARS 1.5 7B) and one frontier model over its API (Claude Opus 5.5), on paired episodes that differ only in who drew the prompt. Under screenshot-only observation on the browser surfaces the agents act on the copy 71%, 74% and 96% of the time. The record then follows the copy under richer observations (the accessibility tree, principal labels), through the published pixel-side defences run on the same screens, and across a text-injection comparison. [RESULTS.md](RESULTS.md) lists every number; the paper reports and interprets them.

What is here