Pith. sign in

REVIEW 4 major objections 5 minor 8 cited by

WebGuard: Building a Generalizable Guardrail for Web Agents

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read WebGuard claims that a few thousand human-labeled actions can train a generalizable guardrail that predicts web-agent action risk far better than zero-shot frontier models.

desk verdict WebGuard ships a genuinely useful action-level risk dataset for web agents, but the headline numbers rest on unvalidated human labels—worth serious refereeing, not blind acceptance. read the letter →

arxiv 2507.14293 v1 pith:LIJY3BMT submitted 2025-07-18 cs.AI cs.CLcs.CV

Boyuan Zheng , Zeyi Liao , Scott Salisbury , Zeyuan Liu , Michael Lin , Qinyuan Zheng , Zifan Wang , Xiang Deng
show 3 more authors
Dawn Song Huan Sun Yu Su
This is my paper
classification cs.AIcs.CLcs.CV
keywords webagentsafetyaction-levelriskassessmentguardrailthree-tierschemageneralizationbenchmarksupervisedfine-tuningmultimodalagentslong-tailwebsites
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

WebGuard is a dataset and benchmark built to answer one question before a web agent acts: if the agent clicks this element or submits this form on a live website, how much harm could follow? The paper collects 4,939 human-annotated actions from 193 real websites across 22 domains, labels each action SAFE, LOW, or HIGH under a three-tier risk schema, and splits the data to test generalization to new actions, new websites, new domains, and long-tail sites. The paper's central finding is that zero-shot frontier models are not adequate guardrails: they score under 60% accuracy and under 60% recall on HIGH-risk actions, whereas a Qwen2.5-VL-7B model fine-tuned on WebGuard reaches about 80% accuracy and 76-80% HIGH-risk recall. The claim that matters is that action-level risk prediction on real websites is learnable from a few thousand examples, while also being still too unreliable for high-stakes deployment without further progress.

What carries the argument

The load-bearing object is the three-tier risk schema (SAFE, LOW, HIGH), which turns an open-ended safety question into a concrete classification target: SAFE covers trivial, reversible, non-state-changing actions; LOW covers minor consequences that only affect the user; HIGH covers significant, irreversible, or legally and financially consequential actions that persist beyond the session. Around this schema, the paper builds an annotation pipeline that records each action with page snapshots, bounding boxes, element metadata, and URLs, and defines the guardrail task as $f(S, A, R) \to y$: predict a risk label from webpage state, proposed action, and schema. The same schema is used to prompt frontier models and to supervise fine-tuning, making the label set and its definitions the unit that carries both the data and the model evaluation.

What would settle it

Take a random sample of the actions that were labeled SAFE by default because no annotator recorded them, have independent annotators re-examine each page and assign a risk label using the same schema, and measure inter-annotator agreement. If a substantial fraction of default-SAFE actions are judged LOW or HIGH by independent annotators, or if Cohen's kappa on a re-annotated subset of all actions is low, the benchmark's ground truth is not stable enough to support the reported accuracy and recall claims.

Watch

Extended reading notes

Core claim

The paper's claim is that the safety of web agents can and should be enforced at the level of individual actions, not whole tasks, and that a generalizable guardrail can be trained for that purpose. WebGuard provides the first large-scale action-level resource for this: 4,939 real-world actions annotated with a three-tier risk schema, collected from 193 live websites in 22 domains including 15 long-tail sites. The authors show that prompting frontier LLMs to reason through state understanding, outcome reasoning, and risk classification yields less than 60% accuracy and less than 60% recall on high-risk actions, and that supervised fine-tuning of Qwen2.5-VL-7B on WebGuard lifts average accuracy from roughly 37-38% to 80.4% and HIGH-risk recall from about 20% to over 76%, with a 3B variant also surpassing much larger zero-shot models. The authors present this as evidence that dedicated, fine-tuned guardrails are the right direction, and explicitly caution that even the best model remains below the near-perfect reliability that real deployment would demand.

Load-bearing premise

The load-bearing premise is that the human labels are correct: the risk schema is defined by the authors, annotators were asked to exhaustively label state-changing actions, any action not annotated is labeled SAFE by default, and no inter-annotator agreement is reported. If annotators missed or disagreed on risky actions, the reported accuracy and recall numbers do not measure what they appear to measure.

Editorial extensions

If this is right

  • Fine-tuning on WebGuard turns a 7B open-weight model into a guardrail that outperforms much larger zero-shot frontier models on accuracy and high-risk recall, so task-specific supervision is a viable path to agent safety.
  • Text-only accessibility-tree inputs beat screenshots in zero-shot prompting, but the pattern reverses after fine-tuning, meaning modality choice should be made jointly with training data.
  • The Cross-Domain split produces the smallest gains after fine-tuning, so generalizing to entirely unseen domains is the main open obstacle for deployable guardrails.
  • Frontier reasoning models still underestimate HIGH-risk actions under zero-shot prompting, so strong general reasoning alone does not remove the need for a dedicated risk classifier.
  • Even the best tuned guardrail remains short of near-perfect accuracy and recall, so high-stakes deployment should keep a human in the loop.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The default-SAFE convention for unannotated actions means the dataset's true coverage of risky actions depends on how exhaustively annotators explored each page; an independent re-audit of default-SAFE actions would reveal whether risk recall is overstated.
  • Because the error analysis shows models rely on surface cues like button labels, the dataset could be extended with post-execution screenshots or before-and-after state diffs to train outcome prediction rather than label prediction.
  • The same three-tier schema and fine-tuning recipe could transfer to mobile GUIs or desktop applications, where action-level risk labeling is currently sparse.
  • A fourth category or a continuous risk score would let users set a safety threshold instead of choosing between LOW and HIGH, which the current three-class formulation cannot express.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces WebGuard, an action-level dataset of 4,939 human-annotated web actions collected from 193 real websites across 22 domains, labeled with a three-tier SAFE/LOW/HIGH risk schema. The authors benchmark frontier LLMs and fine-tuned Qwen2.5/Qwen2.5-VL models on four held-out generalization splits (Long-Tail, Cross-Domain, Cross-Website, Cross-Action). They report that fine-tuning Qwen2.5-VL-7B lifts accuracy from roughly 37% to 80% and HIGH-risk recall from roughly 20% to 76%, while frontier models remain below 60% accuracy and below 60% HIGH-risk recall in zero-shot settings. The dataset, annotation tools, and trained models are released publicly.

Significance. If the label quality is confirmed, WebGuard would be a valuable community resource: it is the first large-scale action-level real-world dataset for web-agent guardrails, and the finding that frontier models have weak zero-shot risk prediction while modest fine-tuned models improve substantially is concrete and falsifiable. The paper uses held-out evaluation splits, includes challenging long-tail websites, and is unusually open about its limitations, including the explicit statement in Appendix G that performance remains below the reliability needed for deployment. The circularity concern raised in the stress-test does not land: the fine-tuned models are scored on actions not used in training, so the main accuracy and recall numbers are not artifacts of memorizing the training labels. The label-validity concern, however, does land: the ground-truth protocol has no reported inter-annotator agreement and a default-SAFE rule that can convert annotation omissions into negative labels, so the evaluation inherits a risk that must be addressed before the headline numbers can be interpreted.

major comments (4)
  1. [Section 2.2 (Data Curation Process)] Section 2.2 states that 'All remaining unannotated actions are then labeled as SAFE by default' and reports no inter-annotator agreement. This protocol converts annotation omissions into negative labels: if an annotator overlooks a state-changing element, the resulting item is recorded as a SAFE example rather than as a labeling error. Because every accuracy and recall figure in Table 2 is scored against labels produced this way, the measured fine-tuning gains and frontier-model deficits could reflect annotators' blind spots rather than true action risk. The review step checks the recorded labels and snapshots, but it cannot detect elements that were never annotated. Please report a sampled inter-annotator agreement study, estimate the fraction of SAFE labels that came from the default rule rather than explicit annotation, and audit a random set of unannotated elements to estimate missed state-changing actions.
  2. [Section 2.2 and Section 4.1] Section 2.2 reports 1,108 HIGH, 2,284 LOW, and 1,564 SAFE actions, which sum to 4,956, while the dataset is stated to contain 4,939 actions. The split sizes in Section 4.1 (143 + 1,669 + 650 + 495 + 1,982 = 4,939) are consistent, so the class-total mismatch is not merely a typo in the total. The per-class counts must be reconciled and the per-split class breakdown reported, since the recall denominators in Table 2 cannot be verified otherwise.
  3. [Section 4.3 and Table 2] Section 4.3 claims that fine-tuned Qwen2.5-VL-7B 'improves HIGH-risk recall by over 60 points across all splits.' According to Table 2, the Cross-Domain improvement is 66.8 - 22.3 = 44.5 points, so the claim is not supported by the table. Please correct the sentence or provide the averaged or weighted numbers that justify it; this matters because the abstract and introduction use these recall gains as headline evidence.
  4. [Section 4.1 (Test splits) and Table 2] Section 4.1 reports that the Long-Tail split contains only 143 actions, and Table 2 reports no confidence intervals or per-class counts for any split. On 143 examples, a small number of prediction changes moves accuracy by roughly a point, and the reported differences between WebGuard-VL-7B and other models in that row are within plausible sampling variation. Please report bootstrap confidence intervals and per-class denominators, especially for the Long-Tail split, before drawing conclusions about long-tail generalization difficulty.
minor comments (5)
  1. [Abstract, Section 1, Section 4.3, Table 2] The headline numbers are internally inconsistent: the abstract reports accuracy from 37% to 80% and HIGH recall from 20% to 76%; the introduction reports 38% to 80% and recall from 20% to 'over 80%'; Section 4.3 says the average accuracy is 80.4%, while the four WebGuard-VL-7B rows in Table 2 average 83.6%. Please reconcile the exact reported values.
  2. [Section 4.2 (Evaluation Metrics)] Section 4.2 says 'we report the average F1 score,' but Table 2 contains no F1 column; either report the F1 values or delete this sentence.
  3. [Table 2] Each model appears twice in Table 2, and the only differentiation is the caption note that text-only models are in gray. Add an explicit row descriptor, such as '(A11y)' for the text-only variant, so the table is interpretable without the caption.
  4. [Section 4.1 (Test splits)] The label 'TestLong-Tail' should be 'Test Long-Tail', and the operational definition of the long-tail traffic distribution should be given in the main text, including the source of traffic data and the cutoff used, since the claim that these websites are underrepresented is central to that split.
  5. [Appendix G (Limitations)] Appendix G lists deployment-related limitations but does not mention the label-validity risk described in my first major comment; if the authors add the label audit, they should also state the residual label risk in the limitations section.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; the fine-tuning gains are measured on held-out splits and do not reduce to dataset construction choices.

full rationale

The paper's central derivation chain is: (1) construct an action-level dataset with human-annotated risk labels, (2) benchmark zero-shot frontier LLMs on held-out test splits, and (3) fine-tune small models on a disjoint training split and evaluate on the same held-out test splits. The reported improvements (accuracy from 37% to 80%, HIGH-risk recall from 20% to 76%) are empirical results against held-out labels, not quantities that are equivalent to the training inputs by construction. The only potentially definitional step is that 'All remaining unannotated actions are then labeled as SAFE by default' (Section 2.2), which operationally defines SAFE as 'not annotated as state-changing'. This is a labeling convention that could affect label validity, and the lack of inter-annotator agreement is a legitimate quality concern, but it does not make the model predictions derive from the definitions: the fine-tuned model must infer risk from webpage features without access to annotation status. The evaluation uses designated held-out splits (Long-Tail, Cross-Domain, Cross-Website, Cross-Action), so the model is not scored on its training actions. The paper cites prior work by the same authors (e.g., WebOlympus for the annotation tool, Mind2Web for context), but these citations are infrastructural or related-work references, not load-bearing justifications for the central claims. No 'uniqueness theorem' or ansatz is smuggled in via self-citation. Therefore, the claims are self-contained relative to the dataset's stated labeling protocol, and the circularity score is low.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central claim is empirical and rests on the validity of the human labels and the risk schema; there are no numeric free parameters fitted to derive the result. The key unverified assumptions are annotation completeness and label agreement, plus the default-SAFE rule.

assumptions (4)
  • ad hoc to paper The three-tier SAFE/LOW/HIGH risk schema is a valid operationalization of action risk.
    Defined in Section 2.1 from author judgment, with no external validation or inter-annotator agreement; all downstream accuracy numbers inherit this assumption.
  • domain assumption Annotators can reliably identify all state-changing actions and their consequences during one-hour homepage explorations.
    Section 2.2 describes the protocol, but the paper reports no completeness audit or agreement statistics.
  • domain assumption Unannotated actions are SAFE by default.
    Section 2.2 states this rule; if annotators miss state-changing actions, the label distribution is biased toward SAFE.
  • domain assumption A static snapshot (screenshot or accessibility tree) plus the proposed action contains sufficient information to determine risk.
    Section 3.2 defines the observation space; some consequences depend on page dynamics not visible in a static snapshot.

how reviews work

0 comments
Cite this review

Pith. "Pith review of WebGuard: Building a Generalizable Guardrail for Web Agents." pith.science (2026). https://pith.science/paper/LIJY3BMT

@misc{pith2026250714293,
  author       = {Pith},
  title        = {Pith review of: WebGuard: Building a Generalizable Guardrail for Web Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LIJY3BMT}},
  note         = {Machine review of arXiv:2507.14293}
}
read the original abstract

The rapid development of autonomous web agents powered by Large Language Models (LLMs), while greatly elevating efficiency, exposes the frontier risk of taking unintended or harmful actions. This situation underscores an urgent need for effective safety measures, akin to access controls for human users. To address this critical challenge, we introduce WebGuard, the first comprehensive dataset designed to support the assessment of web agent action risks and facilitate the development of guardrails for real-world online environments. In doing so, WebGuard specifically focuses on predicting the outcome of state-changing actions and contains 4,939 human-annotated actions from 193 websites across 22 diverse domains, including often-overlooked long-tail websites. These actions are categorized using a novel three-tier risk schema: SAFE, LOW, and HIGH. The dataset includes designated training and test splits to support evaluation under diverse generalization settings. Our initial evaluations reveal a concerning deficiency: even frontier LLMs achieve less than 60% accuracy in predicting action outcomes and less than 60% recall in lagging HIGH-risk actions, highlighting the risks of deploying current-generation agents without dedicated safeguards. We therefore investigate fine-tuning specialized guardrail models using WebGuard. We conduct comprehensive evaluations across multiple generalization settings and find that a fine-tuned Qwen2.5VL-7B model yields a substantial improvement in performance, boosting accuracy from 37% to 80% and HIGH-risk action recall from 20% to 76%. Despite these improvements, the performance still falls short of the reliability required for high-stakes deployment, where guardrails must approach near-perfect accuracy and recall.

Figures

Figures reproduced from arXiv: 2507.14293 by the authors.

Figure 1
Figure 1. Data samples from WebGuard, where elements are labelled as SAFE (green), LOW [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Distribution of websites and domains in WebGuard. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Demonstration of using WebGuard guardrail with web agents. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Annotation Interface 15 [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Example of a Misclassified Intermediate Action. The proposed action involves clicking a checkbox to confirm the user’s acknowledgment of privacy and disclaimer terms during the U.S. passport application process. Although part of a high-stakes workflow, this specific ac…
Figure 6
Figure 6. Figure 6: Example of Overgeneralization Action Effect. The proposed action is to click the “Checkout” button on a purchase page. Although the button may appear to finalize a transaction, it merely advances the user to the next step in the booking process without committing to a …

Discussion (0). Sign in to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Prismata: Confining Cross-Site Prompt Injection in Web Agents

    cs.CR 2026-07 conditional novelty 7.5 of 10

    Prismata cuts web-agent prompt-injection attack success from 85.5% to 0.7% via Biba-inspired DOM trust labeling and mechanical least-privilege confinement without site annotations.

  2. From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    Attackers can force LLM guardrails into extended reasoning loops via optimized payloads, causing 13-63x token amplification and up to 148x latency in agent systems.

  3. SeerGuard: A Safety Framework for Mobile GUI Agents via World Model Prediction

    cs.AI 2026-07 conditional novelty 6.0 of 10

    SeerGuard adds pre-execution instruction screening and action-level semantic next-state prediction to mobile GUI agents, improving safety-utility and risk-cost scores on MobileSafetyBench.

  4. SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents

    cs.CR 2026-04 unverdicted novelty 6.0 of 10

    SnapGuard detects prompt injection attacks on screenshot-based web agents via visual stability indicators and contrast-polarity textual signals, reaching F1 0.75 while running 8x faster than GPT-4o with no added memory cost.

  5. From Refusal to Recovery: A Control-Theoretic Approach to Generative AI Guardrails

    cs.AI 2025-10 unverdicted novelty 6.0 of 10

    Control-theoretic guardrails enable proactive correction of risky LLM agent actions in latent space, preventing catastrophes like collisions or bankruptcy while preserving task performance in simulated environments.

  6. Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI

    cs.SE 2026-04 unverdicted novelty 5.0 of 10

    Agentic AI evaluation and governance lack mechanisms to bind obligations to actions and prove compliance at runtime; a new synthesis framework with ODTA criteria and action-evidence bundles addresses this closure gap.

  7. From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI

    cs.AI 2026-04 unverdicted novelty 4.0 of 10

    The paper presents a layered method to translate governance objectives from standards such as ISO/IEC 42001 into four control layers for agentic AI, with runtime guardrails limited to observable, determinate, and time...

  8. Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security

    cs.AI 2026-05 unverdicted novelty 2.0 of 10

    A survey that maps risks along the agent workflow and consolidates metrics and benchmarks for safety, robustness, privacy, and security in agentic AI.

Reference graph

Works this paper leans on

60 extracted references · 20 canonical work pages · cited by 8 Pith papers

  1. [1]

    Agent S: an open agentic framework that uses computers like a human

    Saaket Agashe, Jiuzhou Han, Shuyu Gan, Jiachen Yang, Ang Li, and Xin Eric Wang. Agent S: an open agentic framework that uses computers like a human. In The Thirteenth Interna- tional Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025 . OpenReview.net, 2025

    work page 2025

  2. [2]

    Digirl: Training in-the-wild device-control agents with autonomous reinforcement learning, 2024

    Hao Bai, Yifei Zhou, Mert Cemri, Jiayi Pan, Alane Suhr, Sergey Levine, and Aviral Kumar. Digirl: Training in-the-wild device-control agents with autonomous reinforcement learning, 2024

    2024

  3. [3]

    Qwen2.5-vl technical report

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Haiyang Xu, and Junyang Lin. Qwen2.5-vl technical report. a...

    arXiv 2025

  4. [4]

    Doomarena: A framework for testing ai agents against evolving security threats

    Leo Boisvert, Mihir Bansal, Chandra Kiran Reddy Evuru, Gabriel Huang, Abhay Puri, Avinandan Bose, Maryam Fazel, Quentin Cappart, Jason Stanley, Alexandre Lacoste, et al. Doomarena: A framework for testing ai agents against evolving security threats. arXiv preprint arXiv:2504.14064, 2025

    arXiv 2025

  5. [5]

    The obvious invisible threat: Llm-powered gui agents’ vulnerability to fine-print injections

    Chaoran Chen, Zhiping Zhang, Bingcan Guo, Shang Ma, Ibrahim Khalilov, Simret A Gebreegzi- abher, Yanfang Ye, Ziang Xiao, Yaxing Yao, Tianshi Li, et al. The obvious invisible threat: Llm-powered gui agents’ vulnerability to fine-print injections. arXiv preprint arXiv:2504.11281, 2025

    arXiv 2025

  6. [6]

    Agentguard: Repurposing agentic orchestrator for safety evaluation of tool orchestration

    Jizhou Chen and Samuel Lee Cong. Agentguard: Repurposing agentic orchestrator for safety evaluation of tool orchestration. arXiv preprint arXiv:2502.09809, 2025

    arXiv 2025

  7. [7]

    Reasoning models don’t always say what they think

    Yanda Chen, Joe Benton, Ansh Radhakrishnan, Jonathan Uesato, Carson Denison, John Schul- man, Arushi Somani, Peter Hase, Misha Wagner, Fabien Roger, et al. Reasoning models don’t always say what they think. arXiv preprint arXiv:2505.05410, 2025

    arXiv 2025

  8. [8]

    Shieldagent: Shielding LLM agents via verifiable safety policy reasoning

    Zhaorun Chen, Mintong Kang, Shuang Yang, and Bo Li. Shieldagent: Shielding LLM agents via verifiable safety policy reasoning. In ICLR 2025 Workshop on Foundation Models in the Wild, 2025

    work page 2025

Show all 60 references
  1. [9]

    SeeClick: Harnessing GUI grounding for advanced visual GUI agents

    Kanzhi Cheng, Qiushi Sun, Yougang Chu, Fangzhi Xu, Li YanTao, Jianbing Zhang, and Zhiyong Wu. SeeClick: Harnessing GUI grounding for advanced visual GUI agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ...

    2024

  2. [10]

    Xu, Siva Reddy, Quentin Cappart, Graham Neubig, Ruslan Salakhutdinov, Nicolas Chapados, and Alexandre Lacoste

    Thibault Le Sellier De Chezelles, Maxime Gasse, Alexandre Drouin, Massimo Caccia, Léo Boisvert, Megh Thakkar, Tom Marty, Rim Assouel, Sahar Omidi Shayegan, Lawrence Keunho Jang, Xing Han Lù, Ori Yoran, Dehan Kong, Frank F. Xu, Siva Reddy, Quentin Cappart, Graham Neubig, Ruslan...

    2024 arXiv

  3. [11]

    Llama guard 3 vision: Safeguarding human-ai image understanding conversations

    Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414, 2024

    2024 arXiv

  4. [12]

    Mind2web: Towards a generalist agent for the web

    Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Samual Stevens, Boshi Wang, Huan Sun, and Yu Su. Mind2web: Towards a generalist agent for the web. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information ...

    2023

  5. [13]

    Preemptive detection and correction of misaligned actions in llm agents, 2024

    Haishuo Fang, Xiaodan Zhu, and Iryna Gurevych. Preemptive detection and correction of misaligned actions in llm agents, 2024

    2024

  6. [14]

    Llama guard 3-1b-int4: Compact and efficient safeguard for human-ai conversations

    Igor Fedorov, Kate Plawiak, Lemeng Wu, Tarek Elgamal, Naveen Suda, Eric Smith, Hongyuan Zhan, Jianfeng Chi, Yuriy Hulovatyy, Kimish Patel, et al. Llama guard 3-1b-int4: Compact and efficient safeguard for human-ai conversations. arXiv preprint arXiv:2411.17713, 2024

    2024 arXiv

  7. [15]

    Navigating the digital world as humans do: Universal visual grounding for GUI agents

    Boyu Gou, Ruohan Wang, Boyuan Zheng, Yanan Xie, Cheng Chang, Yiheng Shu, Huan Sun, and Yu Su. Navigating the digital world as humans do: Universal visual grounding for GUI agents. In The Thirteenth International Conference on Learning Representations, 2025

    2025

  8. [16]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligen...

    2023

  9. [17]

    Is your llm secretly a world model of the internet? model-based planning for web agents, 2024

    Yu Gu, Kai Zhang, Yuting Ning, Boyuan Zheng, Boyu Gou, Tianci Xue, Cheng Chang, Sanjari Srivastava, Yanan Xie, Peng Qi, Huan Sun, and Yu Su. Is your llm secretly a world model of the internet? model-based planning for web agents, 2024

    2024

  10. [18]

    Cogagent: A visual language model for gui agents

    Wenyi Hong, Weihan Wang, Qingsong Lv, Jiazheng Xu, Wenmeng Yu, Junhui Ji, Yan Wang, Zihan Wang, Yuxiao Dong, Ming Ding, and Jie Tang. Cogagent: A visual language model for gui agents. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1...

    2024

  11. [19]

    Sleeper agents: Training deceptive llms that persist through safety training

    Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M Ziegler, Tim Maxwell, Newton Cheng, et al. Sleeper agents: Training deceptive llms that persist through safety training. arXiv preprint arXiv:2401.05566, 2024

    2024 arXiv

  12. [20]

    Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, Aleksander Madry, Alex Baker- Whitcomb, Alex Beutel, Alex Borzunov, Alex Carney, Alex Chow, Alex Kirillov, Alex Nichol, Alex Paino, Alex R...

    arXiv

  13. [21]

    Llama guard: Llm-based input-output safeguard for human-ai conversations

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations. CoRR, abs/2312.06674, 2023

    2023 arXiv

  14. [22]

    Visualwebarena: Evaluating multimodal agents on realistic visual web tasks

    Jing Yu Koh, Robert Lo, Lawrence Jang, Vikram Duvvur, Ming Chong Lim, Po-Yu Huang, Graham Neubig, Shuyan Zhou, Ruslan Salakhutdinov, and Daniel Fried. Visualwebarena: Evaluating multimodal agents on realistic visual web tasks. ArXiv preprint, abs/2401.13649, 2024

    2024 arXiv

  15. [23]

    Tree search for language model agents

    Jing Yu Koh, Stephen McAleer, Daniel Fried, and Ruslan Salakhutdinov. Tree search for language model agents. CoRR, abs/2407.01476, 2024. 11

    2024

  16. [24]

    Hendryx, Summer Yue, and Zifan Wang

    Priyanshu Kumar, Elaine Lau, Saranya Vijayakumar, Tu Trinh, Elaine T Chang, Vaughn Robinson, Shuyan Zhou, Matt Fredrikson, Sean M. Hendryx, Summer Yue, and Zifan Wang. Aligned LLMs are not aligned browser agents. In The Thirteenth International Conference on Learning Represent...

    2025

  17. [25]

    Refusal-trained llms are easily jailbroken as browser agents, 2024

    Priyanshu Kumar, Elaine Lau, Saranya Vijayakumar, Tu Trinh, Scale Red Team, Elaine Chang, Vaughn Robinson, Sean Hendryx, Shuyan Zhou, Matt Fredrikson, Summer Yue, and Zifan Wang. Refusal-trained llms are easily jailbroken as browser agents, 2024

    2024

  18. [26]

    Bradley Knox, and Kimin Lee

    Juyong Lee, Dongyoon Hahm, June Suk Choi, W. Bradley Knox, and Kimin Lee. Mobilesafety- bench: Evaluating safety of autonomous agents in mobile device control.CoRR, abs/2410.17520, 2024

    2024

  19. [27]

    sudo rm-rf agentic_security

    Sejin Lee, Jian Kim, Haon Park, Ashkan Yousefpour, Sangyoon Yu, and Min Song. sudo rm-rf agentic_security. arXiv preprint arXiv:2503.20279, 2025

    2025 arXiv

  20. [28]

    St- webagentbench: A benchmark for evaluating safety and trustworthiness in web agents

    Ido Levy, Ben Wiesel, Sami Marreed, Alon Oved, Avi Yaeli, and Segev Shlomov. St- webagentbench: A benchmark for evaluating safety and trustworthiness in web agents. CoRR, abs/2410.06703, 2024

    2024 arXiv

  21. [29]

    Redteamcua: Realistic adversarial testing of computer-use agents in hybrid web-os environments

    Zeyi Liao, Jaylen Jones, Linxi Jiang, Eric Fosler-Lussier, Yu Su, Zhiqiang Lin, and Huan Sun. Redteamcua: Realistic adversarial testing of computer-use agents in hybrid web-os environments. arXiv preprint arXiv:2505.21936, 2025

    2025

  22. [30]

    EIA: environmental injection attack on generalist web agents for privacy leakage

    Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. EIA: environmental injection attack on generalist web agents for privacy leakage. CoRR, abs/2409.11295, 2024

    2024 arXiv

  23. [31]

    Sycophancy in large language models: Causes and mitigations

    Lars Malmqvist. Sycophancy in large language models: Causes and mitigations. arXiv preprint arXiv:2411.15287, 2024

    2024 arXiv

  24. [32]

    Frontier models are capable of in-context scheming

    Alexander Meinke, Bronson Schoen, Jérémy Scheurer, Mikita Balesni, Rusheb Shah, and Marius Hobbhahn. Frontier models are capable of in-context scheming. arXiv preprint arXiv:2412.04984, 2024

    2024 arXiv

  25. [33]

    Shikhar Murty, Dzmitry Bahdanau, and Christopher D. Manning. Nnetscape navigator: Complex demonstrations for web agents without a demonstrator. CoRR, abs/2410.02907, 2024

    2024 arXiv

  26. [34]

    Testing language model agents safely in the wild

    Silen Naihin, David Atkinson, Marc Green, Merwane Hamadi, Craig Swift, Douglas Schonholtz, Adam Tauman Kalai, and David Bau. Testing language model agents safely in the wild. In Socially Responsible Language Modelling Research, 2023

    2023

  27. [35]

    Operator system card., 2025

    OpenAI. Operator system card., 2025

    2025

  28. [36]

    Explorer: Scaling exploration-driven web trajectory synthesis for multimodal web agents

    Vardaan Pahuja, Yadong Lu, Corby Rosset, Boyu Gou, Arindam Mitra, Spencer Whitehead, Yu Su, and Ahmed Awadallah. Explorer: Scaling exploration-driven web trajectory synthesis for multimodal web agents. CoRR, abs/2502.11357, 2025

    2025 arXiv

  29. [37]

    Agent Q: advanced reasoning and learning for autonomous AI agents

    Pranav Putta, Edmund Mills, Naman Garg, Sumeet Motwani, Chelsea Finn, Divyansh Garg, and Rafael Rafailov. Agent Q: advanced reasoning and learning for autonomous AI agents. CoRR, abs/2408.07199, 2024

    2024 arXiv

  30. [38]

    Webrl: Training LLM web agents via self- evolving online curriculum reinforcement learning

    Zehan Qi, Xiao Liu, Iat Long Iong, Hanyu Lai, Xueqiao Sun, Jiadai Sun, Xinyue Yang, Yu Yang, Shuntian Yao, Wei Xu, Jie Tang, and Yuxiao Dong. Webrl: Training LLM web agents via self- evolving online curriculum reinforcement learning. In The Thirteenth International Conference ...

    2025

  31. [39]

    UI-TARS: pioneering automated GUI interaction with native agents

    Yujia Qin, Yining Ye, Junjie Fang, Haoming Wang, Shihao Liang, Shizuo Tian, Junda Zhang, Jiahao Li, Yunxin Li, Shijue Huang, Wanjun Zhong, Kuanye Li, Jiale Yang, Yu Miao, Woyu Lin, Longxiang Liu, Xu Jiang, Qianli Ma, Jingyu Li, Xiaojun Xiao, Kai Cai, Chuang Li, Yaowei Zheng, C...

    2025 arXiv

  32. [40]

    Towards understanding sycophancy in language models

    Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R Johnston, et al. Towards understanding sycophancy in language models. arXiv preprint arXiv:2310.13548, 2023

    arXiv

  33. [41]

    Hongjin Su, Ruoxi Sun, Jinsung Yoon, Pengcheng Yin, Tao Yu, and Sercan Ö. Arik. Learn-by- interact: A data-centric framework for self-adaptive agents in realistic environments. CoRR, abs/2501.10893, 2025

    2025 arXiv

  34. [42]

    Qwen2.5: A party of foundation models, September 2024

    Qwen Team. Qwen2.5: A party of foundation models, September 2024

    2024

  35. [43]

    Safearena: Evaluating the safety of autonomous web agents

    Ada Defne Tur, Nicholas Meade, Xing Han Lù, Alejandra Zambrano, Arkil Patel, Esin Durmus, Spandana Gella, Karolina Stanczak, and Siva Reddy. Safearena: Evaluating the safety of autonomous web agents. CoRR, abs/2503.04957, 2025

    2025 arXiv

  36. [44]

    Can ai change your view? evidence from a large-scale online field experiment, April 2025

    University of Zurich. Can ai change your view? evidence from a large-scale online field experiment, April 2025. Preprint

    2025

  37. [45]

    Towards understanding chain-of-thought prompting: An empirical study of what matters

    Boshi Wang, Sewon Min, Xiang Deng, Jiaming Shen, You Wu, Luke Zettlemoyer, and Huan Sun. Towards understanding chain-of-thought prompting: An empirical study of what matters. arXiv preprint arXiv:2212.10001, 2022

    2022 arXiv

  38. [46]

    Dissecting adversarial robustness of multimodal LM agents

    Chen Henry Wu, Rishi Rajesh Shah, Jing Yu Koh, Russ Salakhutdinov, Daniel Fried, and Aditi Raghunathan. Dissecting adversarial robustness of multimodal LM agents. In The Thirteenth International Conference on Learning Representations, 2025

    2025

  39. [47]

    Guardagent: Safeguard LLM agents by a guard agent via knowledge-enabled reasoning

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, Dawn Song, and Bo Li. Guardagent: Safeguard LLM agents by a guard agent via knowledge-enabled reasoning. CoRR, abs/2406.09187, 2024

    2024 arXiv

  40. [48]

    Liu, Yiheng Xu, Hongjin Su, Dongchan Shin, Caiming Xiong, and Tao Yu

    Tianbao Xie, Fan Zhou, Zhoujun Cheng, Peng Shi, Luoxuan Weng, Yitao Liu, Toh Jing Hua, Junning Zhao, Qian Liu, Che Liu, Leo Z. Liu, Yiheng Xu, Hongjin Su, Dongchan Shin, Caiming Xiong, and Tao Yu. Openagents: An open platform for language agents in the wild. CoRR, abs/2310.10634, 2023

    arXiv

  41. [49]

    Advweb: Controllable black-box attacks on vlm-powered web agents

    Chejian Xu, Mintong Kang, Jiawei Zhang, Zeyi Liao, Lingbo Mo, Mengqi Yuan, Huan Sun, and Bo Li. Advweb: Controllable black-box attacks on vlm-powered web agents. arXiv preprint arXiv:2410.17401, 2024

    2024 arXiv

  42. [50]

    Set-of-mark prompting unleashes extraordinary visual grounding in gpt-4v

    Jianwei Yang, Hao Zhang, Feng Li, Xueyan Zou, Chunyuan Li, and Jianfeng Gao. Set-of-mark prompting unleashes extraordinary visual grounding in gpt-4v. ArXiv preprint, abs/2310.11441, 2023

    2023 arXiv

  43. [51]

    Benchmarking and defending against indirect prompt injection attacks on large language models

    Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197, 2023

    2023 arXiv

  44. [52]

    Exact: Teaching AI agents to explore with reflective-mcts and exploratory learning

    Xiao Yu, Baolin Peng, Vineeth Vajipey, Hao Cheng, Michel Galley, Jianfeng Gao, and Zhou Yu. Exact: Teaching AI agents to explore with reflective-mcts and exploratory learning. CoRR, abs/2410.02052, 2024

    2024 arXiv

  45. [53]

    Brian Zhang, Eric Mitchell, Hongyu Ren, Kevin Lu, Max Schwarzer, Michelle Pokrass, Shengjia Zhao, Ted Sanders, Adam Tauman Kalai, Alexandre Passos, Benjamin Sokolowsky, Elaine Ya Le, Erik Ritter, Hao Sheng, Hanson Wang, Ilya Kostrikov, James Lee, Johannes Ferstad, Michael Lamp...

  46. [54]

    Attacking vision-language computer agents via pop-ups

    Yanzhe Zhang, Tao Yu, and Diyi Yang. Attacking vision-language computer agents via pop-ups. CoRR, abs/2411.02391, 2024

    2024 arXiv

  47. [55]

    From interaction to impact: Towards safer ai agent through understanding and evaluating mobile ui operation impacts

    Zhuohao (Jerry) Zhang, Eldon Schoop, Jeffrey Nichols, Anuj Mahajan, and Amanda Swearngin. From interaction to impact: Towards safer ai agent through understanding and evaluating mobile ui operation impacts. In Proceedings of the 30th International Conference on Intelligent Use...

    2025

  48. [56]

    Skillweaver: Web agents can self-improve by discovering and honing skills

    Boyuan Zheng, Michael Y Fatemi, Xiaolong Jin, Zora Zhiruo Wang, Apurva Gandhi, Yueqi Song, Yu Gu, Jayanth Srinivasa, Gaowen Liu, Graham Neubig, et al. Skillweaver: Web agents can self-improve by discovering and honing skills. arXiv preprint arXiv:2504.07079, 2025

    2025 arXiv

  49. [57]

    Gpt-4v(ision) is a generalist web agent, if grounded

    Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. Gpt-4v(ision) is a generalist web agent, if grounded. In Forty-first International Conference on Machine Learning, 2024

    2024

  50. [58]

    WebOlympus: An open platform for web agents on live websites

    Boyuan Zheng, Boyu Gou, Scott Salisbury, Zheng Du, Huan Sun, and Yu Su. WebOlympus: An open platform for web agents on live websites. In Delia Irazu Hernandez Farias, Tom Hope, and Manling Li, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language...

    2024

  51. [59]

    Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig

    Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. Webarena: A realistic web environment for building autonomous agents. In The Twelfth International Conference on Learni...

    2024

  52. [60]

    Checkout

    Yifei Zhou, Qianlan Yang, Kaixiang Lin, Min Bai, Xiong Zhou, Yu-Xiong Wang, Sergey Levine, and Li Erran Li. Proposer-agent-evaluator(pae): Autonomous skill discovery for foundation model internet agents. CoRR, abs/2412.13194, 2024. 14 Table of Content: • Appendix A: Website Se...

    2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.