{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:AHEDAF3ORSIQO3NQIPH46J22HT","short_pith_number":"pith:AHEDAF3O","canonical_record":{"source":{"id":"2507.14799","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-20T03:10:13Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3cc036650b357349a47bffd4d083a40180e2c71e9385ec48da1abe89746042cc","abstract_canon_sha256":"f542c46359c7da60a169a85b32a5a8f52697ac2ede4103314e4b140eb154aaaa"},"schema_version":"1.0"},"canonical_sha256":"01c830176e8c91076db043cfcf275a3cf90e22f65727c4929757897c1fab0511","source":{"kind":"arxiv","id":"2507.14799","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.14799","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"arxiv_version","alias_value":"2507.14799v1","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.14799","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"pith_short_12","alias_value":"AHEDAF3ORSIQ","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"pith_short_16","alias_value":"AHEDAF3ORSIQO3NQ","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"pith_short_8","alias_value":"AHEDAF3O","created_at":"2026-07-05T11:40:13Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:AHEDAF3ORSIQO3NQIPH46J22HT","target":"record","payload":{"canonical_record":{"source":{"id":"2507.14799","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-20T03:10:13Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3cc036650b357349a47bffd4d083a40180e2c71e9385ec48da1abe89746042cc","abstract_canon_sha256":"f542c46359c7da60a169a85b32a5a8f52697ac2ede4103314e4b140eb154aaaa"},"schema_version":"1.0"},"canonical_sha256":"01c830176e8c91076db043cfcf275a3cf90e22f65727c4929757897c1fab0511","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:40:13.739126Z","signature_b64":"DuA6JbPtEpW4pYKDBc2eB/WAUy26H0b4iBnfqAwZHcVX7Fp7CjZWPM5aWfbSyk0IISE0+lH8PfBPjWQfhWFyBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"01c830176e8c91076db043cfcf275a3cf90e22f65727c4929757897c1fab0511","last_reissued_at":"2026-07-05T11:40:13.738673Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:40:13.738673Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.14799","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:40:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Os++O0VZ4yR4U13cSzzHiQVUPNtHm2quLQppiWmntsJqbkuhgcnDUCL/FIJvlMRNqylkWxMd+PUZKopbxyf/DQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T09:07:08.486840Z"},"content_sha256":"1336a8ae7d6c88116573caa9e27932a9b6af11ce9dac232363cf6a6c9f4d9597","schema_version":"1.0","event_id":"sha256:1336a8ae7d6c88116573caa9e27932a9b6af11ce9dac232363cf6a6c9f4d9597"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:AHEDAF3ORSIQO3NQIPH46J22HT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Sam Johnson, Thai Le, Viet Pham","submitted_at":"2025-07-20T03:10:13Z","abstract_excerpt":"This work demonstrates that LLM-based web navigation agents offer powerful automation capabilities but are vulnerable to Indirect Prompt Injection (IPI) attacks. We show that adversaries can embed universal adversarial triggers in webpage HTML to hijack agent behavior that utilizes the accessibility tree to parse HTML, causing unintended or malicious actions. Using the Greedy Coordinate Gradient (GCG) algorithm and a Browser Gym agent powered by Llama-3.1, our system demonstrates high success rates across real websites in both targeted and general attacks, including login credential exfiltrati"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.14799","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.14799/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:40:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zO+AsIHiZfZLg2NXottA3XzEhfq+KMHooccaQ/oCX1yrk++C/7/nHQMIACLl0pG/MHxvdF0G/2jCV8/9RuR8Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T09:07:08.488199Z"},"content_sha256":"1577d87da15170ebde96875dc4cbefa8d697f3bb65c11f362380162f241915cb","schema_version":"1.0","event_id":"sha256:1577d87da15170ebde96875dc4cbefa8d697f3bb65c11f362380162f241915cb"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/AHEDAF3ORSIQO3NQIPH46J22HT/bundle.json","state_url":"https://pith.science/pith/AHEDAF3ORSIQO3NQIPH46J22HT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/AHEDAF3ORSIQO3NQIPH46J22HT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T09:07:08Z","links":{"resolver":"https://pith.science/pith/AHEDAF3ORSIQO3NQIPH46J22HT","bundle":"https://pith.science/pith/AHEDAF3ORSIQO3NQIPH46J22HT/bundle.json","state":"https://pith.science/pith/AHEDAF3ORSIQO3NQIPH46J22HT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/AHEDAF3ORSIQO3NQIPH46J22HT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:AHEDAF3ORSIQO3NQIPH46J22HT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f542c46359c7da60a169a85b32a5a8f52697ac2ede4103314e4b140eb154aaaa","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-20T03:10:13Z","title_canon_sha256":"3cc036650b357349a47bffd4d083a40180e2c71e9385ec48da1abe89746042cc"},"schema_version":"1.0","source":{"id":"2507.14799","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.14799","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"arxiv_version","alias_value":"2507.14799v1","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.14799","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"pith_short_12","alias_value":"AHEDAF3ORSIQ","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"pith_short_16","alias_value":"AHEDAF3ORSIQO3NQ","created_at":"2026-07-05T11:40:13Z"},{"alias_kind":"pith_short_8","alias_value":"AHEDAF3O","created_at":"2026-07-05T11:40:13Z"}],"graph_snapshots":[{"event_id":"sha256:1577d87da15170ebde96875dc4cbefa8d697f3bb65c11f362380162f241915cb","target":"graph","created_at":"2026-07-05T11:40:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.14799/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"This work demonstrates that LLM-based web navigation agents offer powerful automation capabilities but are vulnerable to Indirect Prompt Injection (IPI) attacks. We show that adversaries can embed universal adversarial triggers in webpage HTML to hijack agent behavior that utilizes the accessibility tree to parse HTML, causing unintended or malicious actions. Using the Greedy Coordinate Gradient (GCG) algorithm and a Browser Gym agent powered by Llama-3.1, our system demonstrates high success rates across real websites in both targeted and general attacks, including login credential exfiltrati","authors_text":"Sam Johnson, Thai Le, Viet Pham","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-20T03:10:13Z","title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.14799","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1336a8ae7d6c88116573caa9e27932a9b6af11ce9dac232363cf6a6c9f4d9597","target":"record","created_at":"2026-07-05T11:40:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f542c46359c7da60a169a85b32a5a8f52697ac2ede4103314e4b140eb154aaaa","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-20T03:10:13Z","title_canon_sha256":"3cc036650b357349a47bffd4d083a40180e2c71e9385ec48da1abe89746042cc"},"schema_version":"1.0","source":{"id":"2507.14799","kind":"arxiv","version":1}},"canonical_sha256":"01c830176e8c91076db043cfcf275a3cf90e22f65727c4929757897c1fab0511","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"01c830176e8c91076db043cfcf275a3cf90e22f65727c4929757897c1fab0511","first_computed_at":"2026-07-05T11:40:13.738673Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:40:13.738673Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"DuA6JbPtEpW4pYKDBc2eB/WAUy26H0b4iBnfqAwZHcVX7Fp7CjZWPM5aWfbSyk0IISE0+lH8PfBPjWQfhWFyBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:40:13.739126Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.14799","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1336a8ae7d6c88116573caa9e27932a9b6af11ce9dac232363cf6a6c9f4d9597","sha256:1577d87da15170ebde96875dc4cbefa8d697f3bb65c11f362380162f241915cb"],"state_sha256":"8efb4f367f425eb9df7335f05130ac7d6d94313a23d8535f6e10895acb035c0f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jFN36iSQgwP+sWXCF2wmGpPyIT+ZXaqwatV0miBjU+EA1EXfXR5z+zDdBiKsnSrjdhJ79Z976chPaEkyUTwdBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T09:07:08.496085Z","bundle_sha256":"4a66b39fec87321bae1cae0454ac7257425cc6ff71494fd89c3c989a17506e66"}}