Pith. sign in

REVIEW 4 major objections 6 minor 55 references

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LoginTrap demonstrates that a black-box attacker controlling only page content can induce LLM web agents to enter fake login flows and submit sensitive information, with 86% average end-to-end success across LLM backbones and universal…

desk verdict A genuinely useful attack formulation with a clean threat model, but the headline ASR is not yet trustworthy until the SpatialJB layout confound is ablated and the missing defense and artifact material appears. read the letter →

arxiv 2608.04741 v1 pith:MO6LRTIM submitted 2026-08-05 cs.CR

Longtao Guo , Zelin Zhang , Kaifeng Huang , Yang Shi This is my paper · ORCID
classification cs.CR
keywords indirectpromptinjectionwebagentslogininducementphishingauthenticationboundaryprivacyleakagetask-agnosticattackLLMsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that login inducement is a systematic, task-agnostic attack surface for LLM web agents: an attacker who controls only what appears on a webpage can make an agent treat login as a necessary prerequisite, enter a fake login flow, and submit sensitive information, all without knowing the user's task or the agent's internals. The proposed attack, LoginTrap, generates page-specific injection text with a fuzzing-inspired process and embeds it as a popup on a cloned benign page. Across 80 webpages, 1,175 tasks, five website domains, four LLM backbones, and three agent architectures, the attack reaches an average 86% end-to-end success across backbones and 79% across architectures, with every tested page exploitable within nine attempts. A sympathetic reader would care because this turns the routine login prompt into a privacy-leakage channel that current defenses do not fully close.

What carries the argument

The carrying mechanism is the fuzzing-inspired injection generator combined with a controlled login surface. The generator extracts a compact summary and a benign probe task from each page, initializes candidate statements from semantic strategies that frame login as relevant to the page, filters them with two shadow LLMs (one with an extra reminder to be suspicious of webpage instructions), and when none pass, mutates failed candidates using a Monte-Carlo-tree-search-inspired seed-selection policy with crossover, expansion, rephrasing, and compression. The accepted statement is placed in a popup container on a clone of the original page, with the rest of the page unchanged, and clicking the forged login entry leads to an attacker-controlled login page whose description is LLM-generated from the page summary and whose sensitive fields use a fixed line-separated layout. This makes login appear as a plausible, page-consistent prerequisite without directly asking the agent to leak information.

What would settle it

Run the generated LoginTrap pages as live sites with real authentication forms and real (sandboxed) credentials, or add a browser-level phishing warning overlay before the login page; if agents stop submitting sensitive information in either condition, the attack relies on the controlled local environment rather than on general webpage control.

Watch

Extended reading notes

Core claim

The paper's central claim is that a task-agnostic, black-box attacker who controls only the webpage can induce an LLM web agent to treat login as a necessary step and submit sensitive information into an attacker-controlled form. LoginTrap instantiates this by cloning a benign page, inserting a popup with a page-specific login-inducing statement, and routing the agent to a controlled login page. In the evaluation, the average login entry rate was 93% and the average end-to-end attack success was 86% across four LLM backbones with one agent framework; with one fixed LLM and three agent architectures, the average attack success was 79%, and within a nine-attempt budget every tested webpage in every domain was exploitable under at least one backbone.

Load-bearing premise

The load-bearing premise is that a locally cloned page with an injected popup and a template-generated login form is a faithful proxy for a real website with genuine authentication, so agents will act the same way on live services.

Editorial extensions

If this is right

  • An attacker who can place content on any page the agent visits, such as through ads or compromised pages, can push the agent into a login flow and collect sensitive information even when the user's task has nothing to do with login.
  • Swapping the underlying LLM or the agent architecture does not remove the risk; every tested backbone and architecture could be induced to enter the forged login path.
  • Because every tested webpage became exploitable within nine attempts, the risk is page-level and systematic, not limited to a few vulnerable sites.
  • Existing defenses at the instruction, system-prompt, and action-supervision layers reduce leakage but do not eliminate it, so defenses must explicitly reason about whether login is necessary for the task.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: agents that are better at completing tasks once they accept a premise may become more vulnerable, so future improvements in task-following could amplify login-inducement attacks rather than fix them.
  • Editorial inference: the controlled environment's five-step budget and cloned pages mean real-world transfer is still open; live deployments with password-manager prompts, phishing warnings, or richer page states could lower success rates.
  • Editorial inference: a practical defense could gate any login or sensitive-form action on whether authentication is needed for the stated user task, which is directly testable with the paper's dataset.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces LoginTrap, a task-agnostic indirect prompt injection attack that induces LLM-based web agents to initiate an attacker-controlled login flow and submit sensitive background information. The attacker is assumed to control only the cloned webpage content and the induced login page, without knowing the user task or the agent's internals. The attack generates page-specific injection statements through a fuzzing-inspired process that uses GPT-4o for candidate generation and shadow-LLM evaluation. The evaluation is conducted in a local, controlled environment on 80 cloned pages with 1,175 tasks drawn from Mind2Web, and reports Login Entry Rate, Attack Success Rate, and Page Exploitability. The main results are an 86% average end-to-end attack success across four LLM backbones, 79% across three web agent architectures, and 100% page exploitability within a 9-attempt budget for the tested pages.

Significance. If the central claim holds, LoginTrap would establish that black-box webpage control alone can systematically induce LLM-based web agents to cross the login boundary and leak sensitive information, a distinct and realistic threat model for delegated browsing. The paper's strengths include a conservatively stated threat model (no knowledge of the task, model, or architecture), a task-agnostic generation procedure, and an evaluation spanning multiple backbones and architectures. The proposed page-level exploitability metric with attempt-consumption statistics is a useful complement to task-level ASR. However, the significance is contingent on resolving the login-form layout confound and on reporting the missing defense evaluation, both of which currently leave the main quantitative claims ambiguous.

major comments (4)
  1. [§3.3] The login form uses a fixed line-separated layout cited to SpatialJB [29], a known technique for bypassing LLM guardrails. The paper does not ablate the layout, nor does it compare against a conventional login form or a non-login data-collection form with the same layout. As a result, the reported 86% ASR in RQ1 cannot be attributed to the login context or the page-specific injection; it may be produced by the adverarial layout alone. Please add an ablation that varies the form layout while holding the injection and login context fixed, and a control condition with the same layout on a non-login form, to isolate the contribution of login contextualization.
  2. [Abstract and §§4–6] The abstract and conclusion claim that LoginTrap 'remains effective across agent architectures and defenses,' and both §4.1 and §6 mention 'defense settings,' yet no defense experiment is described or reported anywhere in the evaluation. The paper only presents RQ1 and RQ2; there is no table or figure measuring attack success under any defense. The robustness-against-defenses claim is therefore unsupported by the presented evidence and should either be substantiated with new experiments or removed from the abstract and conclusion.
  3. [§4.1 (Implementation)] The injection generator uses GPT-4o for candidate generation and shadow-LLM evaluation, and RQ1 evaluates GPT-4o as one of the agent backbones. This creates a same-family selection bias: the accepted candidate set is tuned to be persuasive to GPT-4o-family models, so the GPT-4o row in Figure 3 partly measures the generator's optimization target rather than the attack's generality. Please report whether the results change when the generator uses a different model family, or provide a per-backbone breakdown of accepted versus rejected candidates to quantify this bias.
  4. [§4.1 (Dataset and Artifacts)] The paper does not release the list of cloned webpages, the generated injection statements, the login templates, or the evaluation harness. Given that the environment is fully controlled and the central claims depend on page-level exploitability, these artifacts are necessary for independent verification. Without them, the reader cannot assess whether the 80 pages are representative or whether 'the rest of the webpage is kept unchanged' (Section 3.3) actually holds. Please make these artifacts available or provide a sufficiently detailed specification for re-execution.
minor comments (6)
  1. [§4.1] The phrase 'follow key research questions' should be 'the following key research questions.'
  2. [§4.2] The sentence 'requires more more attempts' should be 'requires more attempts.'
  3. [§4.3] The sentence 'complete the complete the controlled login form' contains a duplicated phrase and should be corrected.
  4. [Figures 3 and 5] The paper uses 'LOGINTRAP' in some figure captions and 'LoginTrap' in the text; please unify the casing consistently.
  5. [§3.4] The MCTS-inspired mutation policy is described only qualitatively; please specify the number of mutation rounds, the generation budget, and the reward function used for seed selection so the procedure is reproducible.
  6. [§3.3] The reference to SpatialJB [29] as 'a fixed line-separated layout' is too vague; please state explicitly that this is an adversarial text-layout technique known to bypass LLM guardrails and discuss its role in the attack design.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LoginTrap's reported success is measured from executed browser actions, and the GPT-4o-based generation/filtering pipeline is not the source of the final metrics.

full rationale

The paper's derivation chain is not circular. LoginTrap generates candidate injection statements with GPT-4o and filters them through two shadow LLMs (Section 3.4), but the paper explicitly states this process 'is used only for candidate filtering, not for measuring final attack success.' The reported LER, ASR, and PER are labeled from instrumented browser actions—clicks, navigation, and form inputs—executed in fresh Chrome instances (Section 4.1), so the headline numbers are behavioral measurements rather than predictions produced by the generator. No fitted parameter is renamed as a prediction: the shadow-evaluator scores and reward feedback guide candidate selection, but they are never reported as attack success. The fixed line-separated login-form layout cited from SpatialJB is an external implementation choice; while the absence of an ablation may leave a confound in attributing ASR to login framing rather than layout, that is a validity concern, not a step in which a result reduces to its own input by construction. There is no load-bearing self-citation chain, no imported uniqueness theorem, and no ansatz smuggled in via prior work by the same authors. The same-family overlap between the GPT-4o-based generator and one evaluated backbone is a potential generalization bias, but it does not make the derivation self-referential because final success is defined and measured by actual agent browser behavior independent of the generator.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

LoginTrap introduces no new physical or technical entity; it is an attack procedure. Its free parameters are evaluation-budget choices rather than fitted model parameters. The load-bearing assumptions are about the realism of the controlled environment and the transferability of shadow-LLM-based generation to real agents. The paper does not ship artifacts, so the environment itself cannot be inspected.

free parameters (2)
  • Evaluation budget N=3, K=3 = C = 9 attempts per webpage
    The page-level exploitability metric depends on the choice of N=3 tasks and K=3 repetitions. A larger budget would likely raise PER and lower the attempt-consumption statistic. This is a measurement parameter, not a model parameter, but it directly affects the strength of the 'all webpages exploitable' claim.
  • Fixed maximum interaction steps = 5 steps
    All agent executions are truncated at 5 interaction steps. This budget may mechanically favor the attack by preventing the agent from recovering or reconsidering after entering the login flow. It is applied uniformly, but its effect on the reported 86% ASR is not analyzed.
assumptions (4)
  • domain assumption The LLM-based summary and template-generated login page make the induced login flow appear plausible to the agent.
    Section 3.3 states that an LLM summarizes the cloned page and combines it with login templates to generate a description on the login page. The paper assumes this makes the flow consistent with the page context, but it is only validated through the attack success rates in the controlled environment.
  • domain assumption Cloned webpages preserve the decision-relevant context of the original pages.
    Section 4.1 states that the cloning process aims to preserve textual content and layout. If cloning loses dynamic page elements, session state, or interactive components, the measured agent behavior may differ from behavior on the live Mind2Web pages.
  • domain assumption The shadow-LLM evaluation in the fuzzing pipeline is a valid filter for real attack success.
    Section 3.4 uses two shadow LLMs to accept or mutate candidate injections. The final ASR is measured separately with real agents, but the generation process assumes that shadow-model agreement predicts real-agent acceptance. This assumption is not independently validated.
  • domain assumption Delegated execution preserves the same security boundary as human web browsing.
    The framing assumes that an agent submitting synthetic sensitive information to an attacker-controlled page models real credential leakage. Real agents integrated with password managers or external credential systems may behave differently, and real users may be expected to approve such submissions. The paper does not test authenticated or credential-manager-integrated settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents." pith.science (2026). https://pith.science/paper/MO6LRTIM

@misc{pith2026260804741,
  author       = {Pith},
  title        = {Pith review of: LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MO6LRTIM}},
  note         = {Machine review of arXiv:2608.04741}
}
read the original abstract

LLM-based web agents automate user tasks by observing webpages and executing browser actions on behalf of users. As these agents operate on real web services, login becomes a sensitive authentication boundary because it involves credentials and sensitive information. Existing work shows that malicious webpage content can manipulate web agent actions, but it has not fully examined whether such content can induce login and cause end-to-end private data leakage. We study this attack surface and present LoginTrap, a task-agnostic login-inducing attack against LLM-based web agents. LoginTrap assumes a black box attacker that controls the webpage context and the induced login flow without knowing the user task or web agent internals. Under this threat model, LoginTrap uses webpage context to generate page-specific indirect injections through a fuzzing-inspired process, making login appear as a plausible prerequisite for continuing the task and guiding the agent to a controlled login page. We conduct a comprehensive analysis of LoginTrap across realistic web agent executions. The results show that LoginTrap reaches 86\% average end-to-end attack success across LLM backbones and remains effective across agent architectures and defenses. These findings identify login inducement as a systematic authentication boundary risk and motivate further research on authentication-aware defenses for web agents.

Figures

Figures reproduced from arXiv: 2608.04741 by the authors.

Figure 1
Figure 1. Starting only from the original webpage, LoginTrap [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The attack overview of LoginTrap. Given a user task and background information, the web agent first forms an initial [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Domain-wise LER and ASR of LOGINTRAP across different LLM backbones (RQ1). Colors and hatch patterns distinguish the two metrics; the truncated y-axis highlights performance differences. Travel Service Information Shopping Entertainment GPT-4o Gemini 3 Flash Claude Sonnet 4 DeepSeek-V3.2 24/24 (1.38) 16/16 (1.31) 16/16 (1.50) 13/13 (1.00) 11/11 (1.55) 24/24 (1.00) 16/16 (1.06) 16/16 (1.00) 13/13 (1.00) 11/11 (1.00) … view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Page-level exploitability across LLM backbones [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Domain-wise LER and ASR of LOGINTRAP across different web agent architectures (RQ2). Colors and hatch patterns distinguish the two metrics, while the truncated y-axis highlights performance differences. sign choices in browser automation, observation processing, action…
Figure 6
Figure 6. Figure 6: Page-level exploitability across web agent architec [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 41 canonical work pages

  1. [29]

    jailbreak key

    MOU, Z., YANG, J., QIAN, Z., NI, W., XIAO, T., LIU, N., ZHANG, C., QIN, Z.,ANDREN, K. Spatialjb: How text distribution art becomes the" jailbreak key" for llm guardrails.arXiv preprint arXiv:2601.09321 (2026)

    work page Pith review arXiv 2026

  2. [1]

    A {Large-Scale} measurement of website login policies

    ALROOMI, S.,ANDLI, F. A {Large-Scale} measurement of website login policies. In32nd USENIX Security Symposium (USENIX Security 23)(2023), pp. 2061–2078

    work page 2023

  3. [2]

    Agentharm: A benchmark for measuring harmfulness of llm agents

    ANDRIUSHCHENKO, M., SOULY, A., DZIEMIAN, M., DUENAS, D., LIN, M., WANG, J., HENDRYCKS, D., ZOU, A., KOLTER, Z., FREDRIKSON, M.,ET AL. Agentharm: A benchmark for measuring harmfulness of llm agents. InInternational Conference on Learning Representations(2025), vol. 2025, pp. 79185–79220

    work page 2025

  4. [3]

    Phishing activity trends report, 1st quarter 2025

    ANTI-PHISHINGWORKINGGROUP. Phishing activity trends report, 1st quarter 2025. Tech. rep., Anti-Phishing Working Group, July 2025. Activity January–March 2025; published 2 July 2025

    work page 2025

  5. [4]

    Car- bon: domain-independent automatic web form filling

    ARAUJO, S., GAO, Q., LEONARDI, E.,ANDHOUBEN, G.-J. Car- bon: domain-independent automatic web form filling. InInternational Conference on Web Engineering(2010), Springer, pp. 292–306

    work page 2010

  6. [5]

    Vpi-bench: Visual prompt injection attacks for computer-use agents.arXiv preprint arXiv:2506.02456(2025)

    CAO, T., LIM, B., LIU, Y., SUI, Y., LI, Y., DENG, S., LU, L., OO, N., YAN, S.,ANDHOOI, B. Vpi-bench: Visual prompt injection attacks for computer-use agents.arXiv preprint arXiv:2506.02456(2025)

    arXiv 2025

  7. [6]

    Real: Benchmarking autonomous agents on deterministic simu- lations of real websites.Advances in Neural Information Processing Systems 38(2026)

    CAPLES, D., DRAGUNS, A., RAVI, N., PUTTA, P., GARG, N., HEB- BAR, P., JOO, Y., GU, J., LONDON, C., SCHROEDER DEWITT, C., ET AL. Real: Benchmarking autonomous agents on deterministic simu- lations of real websites.Advances in Neural Information Processing Systems 38(2026)

    work page 2026

  8. [7]

    Efficient selectivity and backup operators in monte-carlo tree search

    COULOM, R. Efficient selectivity and backup operators in monte-carlo tree search. InInternational conference on computers and games (2006), Springer, pp. 72–83

    work page 2006

Show all 55 references
  1. [8]

    Decepticon: How dark patterns manipulate web agents.arXiv preprint arXiv:2512.22894(2025)

    CUVIN, P., ZHU, H.,ANDYANG, D. Decepticon: How dark patterns manipulate web agents.arXiv preprint arXiv:2512.22894(2025)

    2025

  2. [9]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents.Advances in Neural Information Processing Systems 37 (2024), 82895–82920

    DEBENEDETTI, E., ZHANG, J., BALUNOVIC, M., BEURER- KELLNER, L., FISCHER, M.,ANDTRAMÈR, F. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents.Advances in Neural Information Processing Systems 37 (2024), 82895–82920

    2024

  3. [10]

    Mind2web: Towards a generalist agent for the web

    DENG, X., GU, Y., ZHENG, B., CHEN, S., STEVENS, S., WANG, B., SUN, H.,ANDSU, Y. Mind2web: Towards a generalist agent for the web. InAdvances in Neural Information Processing Systems(2023), vol. 36, Curran Associates, Inc., pp. 28091–28114

    2023

  4. [11]

    User-driven automation of web form filling

    DIAZ, O., OTADUY, I.,ANDPUENTE, G. User-driven automation of web form filling. InInternational Conference on Web Engineering (2013), Springer, pp. 171–185

    2013

  5. [12]

    ERSOY, D., LEE, B., SHREEKUMAR, A., ARUNASALAM, A., IBRAHIM, M., BIANCHI, A.,ANDCELIK, Z. B. Investigating the impact of dark patterns on llm-based web agents.arXiv preprint arXiv:2510.18113(2025)

    2025

  6. [13]

    Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems 38(2026)

    EVTIMOV, I., ZHARMAGAMBETOV, A., GRATTAFIORI, A., GUO, C., ANDCHAUDHURI, K. Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems 38(2026)

    2026

  7. [14]

    K., SEAMONS, K.,ANDRUOTI, S

    GAUTAM, A., YADAV, T. K., SEAMONS, K.,ANDRUOTI, S. Pass- words are meant to be secret: A practical secure password entry channel for web browsers.arXiv preprint arXiv:2402.06159(2024)

    2024 arXiv

  8. [15]

    {Topic-FlipRAG}:{Topic-Orientated} adversarial opinion manipulation attacks to {Retrieval-Augmented} generation models

    GONG, Y., CHEN, Z., LIU, J., CHEN, M., YU, F., LU, W., WANG, X.,ANDLIU, X. {Topic-FlipRAG}:{Topic-Orientated} adversarial opinion manipulation attacks to {Retrieval-Augmented} generation models. In34th USENIX Security Symposium (USENIX Security 25) (2025), pp. 3807–3826

    2025

  9. [16]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

    GRESHAKE, K., ABDELNABI, S., MISHRA, S., ENDRES, C., HOLZ, T.,ANDFRITZ, M. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. InProceedings of the 16th ACM workshop on artificial intelligence and security(2023), pp. 79–90

    2023

  10. [17]

    Learn- ing to navigate the web.arXiv preprint arXiv:1812.09195(2018)

    GUR, I., RUECKERT, U., FAUST, A.,ANDHAKKANI-TUR, D. Learn- ing to navigate the web.arXiv preprint arXiv:1812.09195(2018)

    2018 arXiv

  11. [18]

    Webvoyager: Building an end-to-end web agent with large multimodal models

    HE, H., YAO, W., MA, K., YU, W., DAI, Y., ZHANG, H., LAN, Z., ANDYU, D. Webvoyager: Building an end-to-end web agent with large multimodal models. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (2024), pp. 6864–6890

    2024

  12. [19]

    Manipulating llm web agents with indirect prompt injection attack via html accessibility tree.arXiv preprint arXiv:2507.14799(2025)

    JOHNSON, S., PHAM, V.,ANDLE, T. Manipulating llm web agents with indirect prompt injection attack via html accessibility tree.arXiv preprint arXiv:2507.14799(2025)

    2025 arXiv

  13. [20]

    Y., LO, R., JANG, L., DUVVUR, V., LIM, M

    KOH, J. Y., LO, R., JANG, L., DUVVUR, V., LIM, M. C., HUANG, P.-Y., NEUBIG, G., ZHOU, S., SALAKHUTDINOV, R.,ANDFRIED, D. Visualwebarena: Evaluating multimodal agents on realistic visual web tasks. InProceedings of the 62nd Annual Meeting of the Associa- tion for Computational ...

    2024

  14. [21]

    Les dissonances: Cross-tool harvesting and polluting in pool-of-tools empowered llm agents

    LI, Z., CUI, J., LIAO, X.,ANDXING, L. Les dissonances: Cross-tool harvesting and polluting in pool-of-tools empowered llm agents. InPro- ceedings of the Network and Distributed System Security Symposium (NDSS)(2026)

    2026

  15. [22]

    Eia: Environmental injection attack on generalist web agents for privacy leakage

    LIAO, Z., MO, L., XU, C., KANG, M., ZHANG, J., XIAO, C., TIAN, Y., LI, B.,ANDSUN, H. Eia: Environmental injection attack on generalist web agents for privacy leakage. InInternational Conference on Learning Representations(2025), vol. 2025, pp. 66972–67003

    2025

  16. [23]

    Fill in the blanks: Empirical anal- ysis of the privacy threats of browser form autofill

    LIN, X., ILIA, P.,ANDPOLAKIS, J. Fill in the blanks: Empirical anal- ysis of the privacy threats of browser form autofill. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security(2020), pp. 507–519

    2020

  17. [24]

    Z., GUU, K., PASUPAT, P., SHI, T.,ANDLIANG, P

    LIU, E. Z., GUU, K., PASUPAT, P., SHI, T.,ANDLIANG, P. Reinforce- ment learning on web interfaces using workflow-guided exploration. arXiv preprint arXiv:1802.08802(2018)

    2018 arXiv

  18. [25]

    H., DIVAKARAN, D

    LIU, R., LIN, Y., YANG, X., NG, S. H., DIVAKARAN, D. M.,AND DONG, J. S. Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach. In31st USENIX Security Symposium (USENIX Security 22)(2022), pp. 1633–1650

    2022

  19. [26]

    LIU, Y., JIA, Y., GENG, R., JIA, J.,ANDGONG, N. Z. Formalizing and benchmarking prompt injection attacks and defenses. In33rd USENIX Security Symposium (USENIX Security 24)(2024), pp. 1831– 1847

    2024

  20. [27]

    LIU, Y., XU, R., WANG, X., JIA, Y.,ANDGONG, N. Z. Wain- jectbench: Benchmarking prompt injection detections for web agents. arXiv preprint arXiv:2510.01354(2025)

    2025

  21. [28]

    Microsoft digital defense report 2025

    MICROSOFT. Microsoft digital defense report 2025. Tech. rep., Mi- crosoft, 2025

    2025

  22. [30]

    Browser use: Enable ai to control your browser

    MÜLLER, M.,ANDŽUNI ˇC, G. Browser use: Enable ai to control your browser. https://github.com/browser-use/browser-use, 2024. Accessed: 2026-05-13. 11

    2024

  23. [31]

    Gui agents: A survey

    NGUYEN, D., CHEN, J., WANG, Y., WU, G., PARK, N., HU, Z., LYU, H., WU, J., APONTE, R., XIA, Y.,ET AL. Gui agents: A survey. In Findings of the Association for Computational Linguistics: ACL 2025 (2025), pp. 22522–22538

    2025

  24. [32]

    End-to-end goal-driven web navigation

    NOGUEIRA, R.,ANDCHO, K. End-to-end goal-driven web navigation. Advances in neural information processing systems 29(2016)

    2016

  25. [33]

    What happens after you leak your password: Understanding cre- dential sharing on phishing sites

    PENG, P., XU, C., QUINN, L., HU, H., VISWANATH, B.,ANDWANG, G. What happens after you leak your password: Understanding cre- dential sharing on phishing sites. InProceedings of the 2019 ACM Asia conference on computer and communications security(2019), pp. 181–192

    2019

  26. [34]

    How americans protect their online data

    PEWRESEARCHCENTER. How americans protect their online data. Tech. rep., Pew Research Center, Oct. 2023

    2023

  27. [35]

    i strongly suspect this website is a scam

    ROY, S., HALDER, S., BHARATY, A., BHASKAR, V., SINHA, Y., KU- MAR, D., PANDA, S.,ANDMANDAL, M. " i strongly suspect this website is a scam": Benchmarking pii leakage and detection without defense in autonomous web agents.arXiv preprint arXiv:2606.00497 (2026)

    2026 arXiv

  28. [36]

    Z.,ANDSUN, L

    SHI, J., YUAN, Z., TIE, G., ZHOU, P., GONG, N. Z.,ANDSUN, L. Prompt injection attack to tool selection in llm agents. InProceedings of the Network and Distributed System Security Symposium (NDSS) (2026)

    2026

  29. [37]

    World of bits: An open-domain platform for web-based agents

    SHI, T., KARPATHY, A., FAN, L., HERNANDEZ, J.,ANDLIANG, P. World of bits: An open-domain platform for web-based agents. InIn- ternational Conference on Machine Learning(2017), PMLR, pp. 3135– 3144

    2017

  30. [38]

    Password managers: Attacks and defenses

    SILVER, D., JANA, S., BONEH, D., CHEN, E.,ANDJACKSON, C. Password managers: Attacks and defenses. In23rd USENIX Security Symposium (USENIX Security 14)(2014), pp. 449–464

    2014

  31. [39]

    Skyvern: Automate browser-based workflows with ai

    SKYVERNAI. Skyvern: Automate browser-based workflows with ai. https://github.com/skyvern-ai/skyvern, 2024. Accessed: 2026-05-13

    2024

  32. [40]

    Muzzle: Adap- tive agentic red-teaming of web agents against indirect prompt injection attacks.arXiv preprint arXiv:2602.09222(2026)

    SYROS, G., ROSE, E., GRINSTEAD, B., KERSCHBAUMER, C., ROBERTSON, W., NITA-ROTARU, C.,ANDOPREA, A. Muzzle: Adap- tive agentic red-teaming of web agents against indirect prompt injection attacks.arXiv preprint arXiv:2602.09222(2026)

    2026

  33. [41]

    G., SZALACHOWSKI, P.,ANDZHOU, J

    TAN, T. G., SZALACHOWSKI, P.,ANDZHOU, J. Securing password authentication for web-based applications. In2022 IEEE Conference on Dependable and Secure Computing (DSC)(2022), IEEE, pp. 1–10

    2022

  34. [42]

    Digital iden- tity guidelines: Authentication and authenticator management

    TEMOSHOK, D., FANTO, S., NEWTON, E., PERLNER, R., REGEN- SCHEID, A., BURR, W., RICHER, J., LEFKOVITZ, N., DANKER, J., CHOONG, Y.-Y., GREENE, K.,ANDTHEOFANOS, M. Digital iden- tity guidelines: Authentication and authenticator management. NIST Special Publication 800-63B-4, Nati...

    2025

  35. [43]

    Adinject: Real-world black-box attacks on web agents via advertising delivery.arXiv preprint arXiv:2505.21499(2025)

    WANG, H., WANG, J., JIA, X., ZHANG, R., LI, M., LIU, Z., LIU, Y., ANDWANG, Q. Adinject: Real-world black-box attacks on web agents via advertising delivery.arXiv preprint arXiv:2505.21499(2025)

    2025 arXiv

  36. [44]

    Manipulating multimodal agents via cross- modal prompt injection

    WANG, L., YING, Z., ZHANG, T., LIANG, S., HU, S., ZHANG, M., LIU, A.,ANDLIU, X. Manipulating multimodal agents via cross- modal prompt injection. InProceedings of the 33rd ACM International Conference on Multimedia(2025), pp. 10955–10964

    2025

  37. [45]

    WANG, R., JIA, Y.,ANDGONG, N. Z. Obliinjection: Order-oblivious prompt injection attack to llm agents with multi-source data. InPro- ceedings of the Network and Distributed System Security Symposium (NDSS)(2026)

    2026

  38. [46]

    When bots take the bait: Exposing and mitigating the emerging social engineering attack in web automation agent.arXiv preprint arXiv:2601.07263(2026)

    WU, X., HONG, G., CHEN, Y., LIU, M., JIN, F., PAN, X., DAI, J., ANDLIU, B. When bots take the bait: Exposing and mitigating the emerging social engineering attack in web automation agent.arXiv preprint arXiv:2601.07263(2026)

    2026

  39. [47]

    H., GOU, B., SONG, D., SUN, H.,ANDSU, Y

    XUE, T., QI, W., SHI, T., SONG, C. H., GOU, B., SONG, D., SUN, H.,ANDSU, Y. An illusion of progress? assessing the current state of web agents. InSecond Conference on Language Modeling(2025)

    2025

  40. [48]

    Set-of- mark prompting unleashes extraordinary visual grounding in gpt-4v

    YANG, J., ZHANG, H., LI, F., ZOU, X., LI, C.,ANDGAO, J. Set-of- mark prompting unleashes extraordinary visual grounding in gpt-4v. arXiv preprint arXiv:2310.11441(2023)

    2023 arXiv

  41. [49]

    Litewebagent: The open-source suite for vlm-based web-agent applications

    ZHANG, D., RAMA, B., NI, J., HE, S., ZHAO, F., CHEN, K., CHEN, A.,ANDCAO, J. Litewebagent: The open-source suite for vlm-based web-agent applications. InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: ...

    2025

  42. [50]

    Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents

    ZHANG, H., HUANG, J., MEI, K., YAO, Y., WANG, Z., ZHAN, C., WANG, H.,ANDZHANG, Y. Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents. InInter- national Conference on Learning Representations(2025), vol. 2025, pp. 35331–35366

    2025

  43. [51]

    Browsesafe: Understanding and preventing prompt in- jection within ai browser agents.arXiv preprint arXiv:2511.20597 (2025)

    ZHANG, K., TENENHOLTZ, M., POLLEY, K., MA, J., YARATS, D., ANDLI, N. Browsesafe: Understanding and preventing prompt in- jection within ai browser agents.arXiv preprint arXiv:2511.20597 (2025)

    2025

  44. [52]

    Attacking vision-language com- puter agents via pop-ups

    ZHANG, Y., YU, T.,ANDYANG, D. Attacking vision-language com- puter agents via pop-ups. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (2025), pp. 8387–8401

    2025

  45. [53]

    Genesis: Evolving attack strategies for llm web agent red-teaming.arXiv preprint arXiv:2510.18314(2025)

    ZHANG, Z., HE, J., CAI, Y., YE, D., ZHAO, P., FENG, R.,AND WANG, H. Genesis: Evolving attack strategies for llm web agent red-teaming.arXiv preprint arXiv:2510.18314(2025)

    2025

  46. [54]

    Mind your server: A systematic study of parasitic toolchain attacks on the mcp ecosystem.arXiv preprint arXiv:2509.06572(2025)

    ZHAO, S., HOU, Q., ZHAN, Z., WANG, Y., XIE, Y., GUO, Y., CHEN, L., LI, S.,ANDXUE, Z. Mind your server: A systematic study of parasitic toolchain attacks on the mcp ecosystem.arXiv preprint arXiv:2509.06572(2025)

    2025 arXiv

  47. [55]

    {PoisonedRAG}: Knowl- edge corruption attacks to {Retrieval-Augmented} generation of large language models

    ZOU, W., GENG, R., WANG, B.,ANDJIA, J. {PoisonedRAG}: Knowl- edge corruption attacks to {Retrieval-Augmented} generation of large language models. In34th USENIX Security Symposium (USENIX Security 25)(2025), pp. 3827–3844. 12

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.