REVIEW 24 cited by
EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Generalist web agents have demonstrated remarkable potential in autonomously completing a wide range of tasks on real websites, significantly boosting human productivity. However, web tasks, such as booking flights, usually involve users' PII, which may be exposed to potential privacy risks if web agents accidentally interact with compromised websites, a scenario that remains largely unexplored in the literature. In this work, we narrow this gap by conducting the first study on the privacy risks of generalist web agents in adversarial environments. First, we present a realistic threat model for attacks on the website, where we consider two adversarial targets: stealing users' specific PII or the entire user request. Then, we propose a novel attack method, termed Environmental Injection Attack (EIA). EIA injects malicious content designed to adapt well to environments where the agents operate and our work instantiates EIA specifically for privacy scenarios in web environments. We collect 177 action steps that involve diverse PII categories on realistic websites from the Mind2Web, and conduct experiments using one of the most capable generalist web agent frameworks to date. The results demonstrate that EIA achieves up to 70% ASR in stealing specific PII and 16% ASR for full user request. Additionally, by accessing the stealthiness and experimenting with a defensive system prompt, we indicate that EIA is hard to detect and mitigate. Notably, attacks that are not well adapted for a webpage can be detected via human inspection, leading to our discussion about the trade-off between security and autonomy. However, extra attackers' efforts can make EIA seamlessly adapted, rendering such supervision ineffective. Thus, we further discuss the defenses at the pre- and post-deployment stages of the websites without relying on human supervision and call for more advanced defense strategies.
Forward citations
Cited by 24 Pith papers
-
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Prismata cuts web-agent prompt-injection attack success from 85.5% to 0.7% via Biba-inspired DOM trust labeling and mechanical least-privilege confinement without site annotations.
-
Agent Security Needs Redefinition through a Holistic Framework
Agent security should be redefined around four contextual authorization properties instead of the content of the action performed.
-
Modeling Distinct Human Interaction in Web Agents
A new corpus and fine-tuned language models predict when web-agent users will intervene, with a small user study reporting 26.5% higher perceived usefulness.
-
Mind the Gap: Action Rebinding Attacks against Android GUI Agents
A zero-permission Android app can redirect a GUI agent's planned tap to a different app by switching the foreground during the agent's reasoning delay.
-
When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents
The paper claims prompt compression is a new attack surface, but the abstract's COMA attack never appears in the body and the body's SoftCom requires white-box access.
-
WebGuard: Building a Generalizable Guardrail for Web Agents
WebGuard introduces an action-level risk dataset for web agents and shows that a fine-tuned 7B model improves risk-prediction accuracy from about 38% to 80% and high-risk recall from 20% to 76%, still below deployment...
-
ASSURE: Metamorphic Testing for AI-powered Browser Extensions
A modular metamorphic testing framework for LLM-based browser extensions reports 531 automatically detected issues across six real-world extensions.
-
MLA-Trust: Benchmarking Trustworthiness of Multimodal LLM Agents in GUI Environments
MLA-Trust introduces 34 tasks and an evaluation toolbox showing that GUI-interacting multimodal agents are substantially less trustworthy than static multimodal chat models.
-
RiOSWorld: Benchmarking the Risk of Multimodal Computer-Use Agents
Multimodal computer-use agents show risky intent in about 85% of tasks and complete risky actions in about 60%, measured on RiOSWorld, a new 492-task virtual-machine benchmark.
-
AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery
Fake 'Close AD' ads make VLM web agents click them over 60% of the time, and near 100% in some settings.
-
Superplatforms Have to Attack AI Agents
Superplatforms are predicted to launch stealth, black-box attacks on AI agents because agents threaten their ad-based gatekeeping revenue.
-
SafeAgent: Safeguarding LLM Agents via an Automated Risk Simulator
This paper introduces AutoSafe, an automated pipeline that generates agent risk scenarios, samples safe actions via self-reflection, and fine-tunes LLM agents to improve safety on synthetic and real-world benchmarks.
-
From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents
All nine tested mobile LLM agents are vulnerable to at least one of 11 identified attack surfaces, with UI manipulation and deeplink forgery among the most effective.
-
Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models
Embedding iteratively refined HTML policy text can make web-retrieval LLMs refuse to disclose page content, with measured defense success rising from 2.5% to 88.6%.
-
AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents
AgentVigil uses Monte Carlo Tree Search and coverage-guided scoring to automatically craft indirect prompt injection attacks that succeed 71% and 70% of the time on two agent benchmarks, about double the baseline.
-
MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
MELON detects indirect prompt injection in LLM agents by re-executing each step with the user prompt replaced by a neutral task prompt and flagging attacks when the original and masked runs produce similar tool calls.
-
Software Engineering for and with GUI Agent
A survey of 336 GUI-agent papers finds rapid growth alongside weak engineering support for recovery, human oversight, maintainability, and privacy, and calls for lifecycle-centered testing and governance.
-
Agents at Risk: How Users Unwittingly Undermine LLM Safety
Commercial AI agents routinely trust user-relayed unverified content and execute risky actions unless the user explicitly demands a safety check.
-
Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment
Attacker-controlled tool descriptions and return values can hijack tool invocation in popular LLM coding agents, yielding remote code execution and denial of service.
-
PromptArmor: Simple yet Effective Prompt Injection Defenses
PromptArmor prompts a separate LLM to detect and remove injected prompts from agent inputs, achieving below 1% false positive and false negative rates on AgentDojo.
-
Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunities
A survey that groups graph-empowered AI agent research into planning, execution, memory, and multi-agent coordination, plus agents-for-graphs and applications.
-
Toward Generalizable Evaluation in the LLM Era: A Survey Beyond Benchmarks
A survey that frames the core problem of LLM evaluation as 'evaluation generalization': finite test sets cannot scale with unbounded model capabilities, and proposes two transitions in evaluation design.
-
Toward a Human-Centered Evaluation Framework for Trustworthy LLM-Powered GUI Agents
The paper calls for privacy and security to be core evaluation criteria for LLM-powered GUI agents through human-centered assessment, in-context consent, and built-in safeguards.
-
OS Agents: A Survey on MLLM-based Agents for General Computing Devices Use
A structured survey of MLLM-based OS Agents that control computers and mobile devices through GUIs, covering models, frameworks, evaluation protocols, and benchmarks.
Discussion (0). Continue with ORCID to comment.