Researchers propose a Web threat model for agent browsers, catalog 20 attack types, and reproduce them on 4 models

This paper attempts to address the security threats and failure mechanisms of agent browsers when facing traditional web attackers who exploit legitimate interaction patterns rather than explicit instructions.

• Interaction paradigm shift and failure of security trust assumptions: Major vendors have integrated LLMs into browsers to autonomously perform page navigation and interaction; traditional web security models assume human users are the final arbiters of interaction and authorization, but in agent browsers, probabilistic models control this, and attackers can induce agents to perform privileged operations by crafting page content.
• Limitations of existing defense perspectives: Previous security research on agent browsers mainly focused on indirect prompt injection, abstracting security issues as input sanitization and filtering problems; the authors argue this overlooks traditional web confusion attacks that exploit normal interaction patterns such as phishing, fraud, and interface mimicry.
• Core assumption of the confused deputy: The authors model the LLM in agent browsers as a Confused Deputy, where the agent is authorized to perform privileged operations on behalf of the user but cannot distinguish between legitimate and malicious page components during decision-making, lacking origin awareness and a model of attacker intent.
• Threat Model:
  • Attacker Target: Obtain same-site data, unauthorized access or exfiltration of cross-site data, or control of the user's system and local resources.
  • Attacker Capability: Divided into gadget attackers who can only control HTML/CSS markup, and web attackers with full JavaScript execution and control over malicious origins.
  • Attacker Knowledge and Assumptions: Attackers control page state, do not need to exploit traditional memory safety vulnerabilities or logic privilege escalation vulnerabilities; they do not have capabilities beyond ordinary JavaScript and rendered HTML, and cannot break HTTPS/TLS.
  • Victim System: Agent browsers operating on the See→Act model, with capabilities for page interaction (a^p), cross-origin navigation (a^n), browser UI operations (a^b), and integration of external tools (a^x).
• Research Approach: The authors claim to propose the first web-oriented threat model for agent browsers, outlining a taxonomy of 20 attacks covering both web and LLM dimensions, and based on this, summarizing 5 categories of macro-level failure modes.

Agentic browser prototype and interaction model

• See→Act and its predecessor frameworks: Zhang et al. (2024) proposed the See→Act model, enabling LLMs to generate browser actions based on webpage screenshots and clickable regions; Yao et al. proposed the ReAct framework, establishing an interaction paradigm of alternating reasoning and action execution.
• Autonomous browsing benchmarks: Deng et al. (2023) proposed Mind2Web, and Zhou et al. (2024) proposed WebArena, evaluating the ability of LLM agents to autonomously complete complex web tasks with minimal human supervision.

Agent security and prompt injection research

• WASP benchmark: Evtimov et al. (2025) embedded explicit instructions (e.g., ignore the text below, focus on the target above) in HTML anchor tags to alter agent behavior; the authors note that this benchmark only focuses on single-site interaction targets and does not involve complex cross-site interactions or operations on user systems.
• DoomArena benchmark: Boisvert et al. (2025) used hidden text, long instruction sequences, and delimiters to inject adversarial instructions into agents; the authors note that it only tests original navigation requests with a single indirect prompt injection attack.
• Environment injection and privacy leakage: Liao et al. (2025) proposed EIA, using environment injection attacks against general web agents to obtain privacy; Ma et al. evaluated the sensitivity of multimodal LLM agents to environmental interference; Greshake et al. (2023) and Wu et al. (2024) studied the threat of indirect prompt injection in web agents.

Traditional web security architecture and defense models

• Browser security model: Barth et al. (2008) formalized the security architecture of the Chromium browser; Akhawe et al. (2010) built a formal foundation for web security, proposing the gadget attacker and web attacker models.
• Classic web threat assessment: Knittel et al. (2021) proposed XSinator.com for automated evaluation of cross-site leaks (XS-Leaks); Huang et al. analyzed clickjacking; Spaulding et al. (2017) studied the effectiveness of typosquatting techniques.

Baseline methods and benchmarks

• Comparison baseline and defense model: The paper compares BrowseSafe proposed by Perplexity AI (Zhang et al., 2025) when evaluating defenses; this model serves as an open-source intermediate filtering model, aiming to filter malicious prompt injections before input reaches the LLM.
• Positioning and distinction of this paper: The authors point out that existing agent security benchmarks limit threats to indirect prompt injection in the form of explicit instructions, ignoring confusion attacks launched by traditional web attackers through phishing, scams, and UI disguise; this paper combines traditional web attack models with See→Act, establishing a systematic attack taxonomy covering cross-origin interactions and system integration.

The authors introduce traditional web security primitives into agent systems, extend the See→Act threat model and derive a taxonomy containing 20 attacks, further summarized into 5 categories of macroscopic failure modes.

Extended See→Act formal model

• Refined action space: To characterize the agent's over-privileged capabilities, the authors decompose agent actions into four mutually exclusive operations, i.e., a_t ∈ {a^p, aⁿ, a^b, a^x}, including page interaction a^p, cross-origin navigation aⁿ, browser built-in UI interaction a^b, and external integrated tool invocation a^x.
• Introducing web security context: The browser state is extended to s_t+1 = {h_t, i_t, o_t, ℰ_t}, explicitly incorporating the currently displayed origin o_t and the set of attacker-controlled elements ℰ_t on the basis of webpage markup data h_t and interaction metadata i_t.
• Confused deputy and attacker modeling: The attacker can inject specific elements or scripts into controlled origins; its goal is defined as the target origin o^v, constraint conditions e^v, and privileged operations a^M that prompt the agent to invoke.

Cartesian product of attack dimensions and taxonomy derivation

• Dimension enumeration and filtering: The authors enumerate browser capabilities (4 types), input representations (HTML markup and annotated screenshots, 2 types), attacker capabilities (gadget and web attackers, 2 types), and attack targets (same-site, cross-site, system, 3 types), totaling 60 possible combinations (Table 5).
• Excluding unreasonable combinations: Two authors independently reviewed and, based on two criteria—physical infeasibility (e.g., the model has no data access permission) and over-privilege relative to the web security model (e.g., script attacker attacking same-site data)—excluded 20 combinations.
• Mapping and deduplication: The remaining 38 combinations were mapped to web security literature and LLM threats; after deduplication, 20 attacks were identified (Table 1); among them, 10 have similar attacks in the modern web, and 10 have no direct counterparts in traditional web security literature.

5 categories of macroscopic failure modes

• Agent bridges same-site data (SS): A gadget attacker controls part of user-generated content, inducing the agent to read same-origin sensitive information (e.g., CSRF tokens) and write it back to attacker-controlled areas, without executing scripts on the page.
• Agent bridges cross-site data (XS): When operating across multiple tabs, the agent is induced to transfer information between different origins or initiate cross-site operations, breaking the same-origin policy and isolation mechanisms.
• Agent hallucinates URLs (SQ): When target elements are not visible, the agent tends to speculate and generate seemingly plausible paths or domain names (e.g., /settings or subdomains); attackers can pre-register these resources to intercept traffic (Slop squatting).
• Website attacks the LLM itself (LLM): Malicious sites detect agent access characteristics to provide differentiated content, or use fake pop-ups to extract credentials and privacy from the prompt (Prompt leakage and Fingerprinting).
• Agent abuses integrated tools (I): When the agent is connected to tools such as file systems, code execution, or external APIs, malicious webpages induce it to invoke these legitimate tools, leading to over-privileged access or code execution on the host system.

Proof-of-concept implementation

• Proof-of-concept construction: The authors built proof-of-concept (PoC) implementations for 18 attacks in the taxonomy, covering Playwright-MCP and BrowserOS environments; the remaining 2 attacks did not have PoCs due to the lack of corresponding trigger interfaces.

Experimental Setup

• Tested Models: Generalization evaluation tested 4 models: GPT-5, Claude-Sonnet-4.6, Kimi-k2p5, Qwen3.6 Plus; case studies tested ChatGPT Operator, ChatGPT Atlas, Perplexity Comet; prompt injection development used the open-source model GPT-OSS; defense evaluation tested the BrowseSafe model.
• Experimental Environment and Testing Tools: Used a testing tool based on Playwright-MCP (v0.0.64) and the unmodified open-source commercial agent browser BrowserOS (v0.40.1); added file system and remote code execution tools via MCP.
• Evaluation Protocol and Sample Size: Automated generalization testing was conducted for 14 attacks, with each model running each attack 10 times; session time was limited to 2 minutes (120 seconds), stopping on timeout or successful attack.
• Success Criteria: Success was determined only when the agent fully completed all operations set by the attack (e.g., successfully submitting specific credentials, or accessing a third-party domain and returning a matching cookie); agent lying, guessing, or failing to return target data was not counted as success.

Main Results

Swipe horizontally to read the table

Model	SS-1 (Same-site data leakage)	XS-2 (Cross-site action confusion)	XS-3 (Cross-site leakage)	XS-6 (Private network access)	SQ-1 (Path squatting)
GPT-5	7/10	7/10	7/10	6/10	10/10
Kimi-k2p5	10/10	6/10	8/10	8/10	10/10
Claude-Sonnet-4.6	1/10	10/10	4/10	10/10	10/10
Qwen3.6 Plus	9/10	9/10	8/10	9/10	10/10

According to Table 2, the table selects 5 typical attacks spanning different failure modes, showing the number of successes in 10 runs for each model (omitting the remaining 9 generalization-tested attacks and attacks not tested for generalization).

• Traditional confusion attacks are reproducible across models: The authors report that cross-site action confusion (XS-2), private network data access (XS-6), and path squatting (SQ-1) maintain high success rates across all 4 models, with SQ-1 being 10/10 on all 4 models.
• Differences in susceptibility between confusion and injection attacks: The authors found that models are more susceptible to confusion attacks disguised as normal interactions (e.g., XS-2, SS-1) than to traditional prompt injection (e.g., XS-1, SS-3); in SS-3, except for GPT-5 achieving 3/10, the other three models all scored 0/10, while in SS-1, Kimi-k2p5 and Qwen3.6 Plus reached 10/10 and 9/10 respectively.
• Claude-Sonnet-4.6 behavior: Claude-Sonnet-4.6 had lower success rates in several tests (e.g., SS-1 at 1/10, and SS-3, SS-4, SS-5, XS-4, XS-5 all at 0/10), which the authors attribute to the model's tendency to treat the evaluation as a cybersecurity benchmark and proactively deobfuscate JavaScript in CAPTCHAs.

Effectiveness Evaluation Against the BrowseSafe Defense Model

• Test Setup: Selected Perplexity AI's open-source intermediate filtering model BrowseSafe, evaluating its interception capability against 4 types of confusion attacks (Prompt leakage, Same-site action-oriented confusion, Integration-based attack, Cross-site action-oriented confusion).
• Evaluation Results: In all 4 confusion attack scenarios, BrowseSafe failed to identify them as malicious content, classifying all as benign pages (4/4 missed detections).
• Authors' Interpretation: The authors believe BrowseSafe relies solely on explicit prompt injection patterns for detection and cannot provide defense against traditional confusion attacks that lack adversarial instruction text and rely on legitimate interaction contexts.

Case Studies on Commercial and Open-Source Agent Browsers

• Same-site action confusion (SS-4): In tests inducing key submission on a bulletin board interface, after adding authorization phrases to the prompt, both Perplexity Comet and ChatGPT Operator copied and published the key, while ChatGPT Atlas flagged it as indirect prompt injection and required manual confirmation.
• Universal cross-site scripting (XS-4): On Playwright-MCP and BrowserOS, models executed obfuscated scripts and returned third-party cookies; when not obfuscated, models attempted to directly extract URLs for navigation.
• Integrated remote code execution (I-5): In an internship application scenario, GPT-5 called tools on Playwright-MCP to write Python files; ChatGPT Operator and Atlas called built-in tools to execute code on cloud servers.
• URL hallucination squatting (SQ-1 and SQ-2): In tests with a fake Reddit page, all tested models hallucinated internal subpaths or blog subdomains on both Playwright-MCP and BrowserOS.

Other Ablations and Analyses

• BrowserOS system prompt changes: The December 2025 prompt update caused agents to confirm more with users, leading to attack failures, but adding authorization phrases to user prompts restored attack success (Table 2).
• Automated generalization excluded domain squatting (SQ-2): Because it was difficult to stably convert navigation to a controlled domain into observable proxy hits, it was not included in the automated generalization table (Section 7).
• Permission abuse (I-1) and extension silent installation (I-2): PoC and generalization tests were not conducted because the test platform lacked corresponding interaction interfaces (Table 1, Table 2).
• Impact of tool call removal on attacks: Perplexity Comet supported remote code execution attacks in September 2025, but after removing related tool calls in November 2025, the attack could not be reproduced (Section 6.2.4).

Limitations and future directions noted by the authors

• Invisibility of chain-of-thought limits mechanism analysis: When evaluating Claude-Sonnet-4.6, because the official API does not expose its thinking tokens, the authors could not deeply investigate the underlying reasons for the model's deobfuscation scripts and performance differences (Section 7).
• Difficulty in automating domain squatting evaluation: The success determination for domain squatting (SQ-2) depends on the agent navigating to an attacker-controlled domain, which cannot be stably converted into observable agent hits in existing test tools, preventing stable automated evaluation of this attack (Section 7).
• Some attacks lack trigger interfaces: Permission abuse (I-1) and silent extension installation (I-2) lack agent interfaces in Playwright-MCP and BrowserOS to trigger corresponding capabilities, so they cannot currently be tested (Section 5.4).
• Minimize agent capability scope: The authors suggest browser vendors use the taxonomy to limit agent capabilities to the minimum scope required for target workflows, avoiding unnecessary opening of navigation or browser UI permissions (Section 8).
• Introduce explicit structured trust annotations: The current Web lacks same-site content trust markers; the authors suggest developers mark trusted regions and untrusted UGC regions via HTML structural attributes to assist LLMs in trust decisions (Section 8).
• Build security mediation based on threat models: The authors propose restructuring the trust architecture between browsers and agents, introducing rules or intervention mechanisms that are aware of agent threat models, and intervening to block when operations exceed boundaries (Section 8).

Experimental coverage

• Model scope tested: Automated generalization tests cover 4 models (GPT-5, Claude-Sonnet-4.6, Kimi-k2p5, Qwen3.6 Plus); case studies cover ChatGPT Operator, ChatGPT Atlas, Perplexity Comet, and BrowseSafe.
• Test framework and attack count: 18 PoC scenarios were built based on Playwright-MCP and BrowserOS, with 10 repeated tests for 14 of them; I-1 and I-2 were not tested.
• Test time budget: Each test had a 120-second (2-minute) time limit, terminating on timeout or success (Section 6.1, Appendix B).
• Metrics not reported in the paper: The paper does not report token consumption, API query overhead, or execution time for each attack; it does not report registration interception and hijacking statistics on real domains on the open internet.

This paper studies the security of agentic browsers when facing traditional Web attackers, pointing out that current security assumptions against prompt injection cannot defend against obfuscation attacks based on normal Web interaction patterns.

• Problem statement: Connecting LLMs to browsers breaks the traditional assumption of humans as security arbiters; agents as obfuscation proxies cannot distinguish legitimate components from maliciously constructed page content.
• Threat model and taxonomy: The authors extend the See→Act model, combine it with Chromium and Web attacker models, and derive and construct a taxonomy of 20 attacks from three dimensions: browser capabilities, attacker capabilities, and goals.
• 5 macro failure modes: The attacks are grouped into 5 patterns: same-site data bridging, cross-site data bridging, URL squatting, reverse attacks against LLMs, and integrated tool abuse.
• Proof of concept and defense failure: 18 PoC attacks were constructed; in testing, Perplexity AI's BrowseSafe detector missed all 4 categories of obfuscation attacks.
• Generalization test results: In tests across 4 frontier and open-source models, path squatting achieved a 10/10 success rate on all models; models showed higher compliance with obfuscation attacks disguised as benign interfaces than with explicit prompt injection.
• Implications and defense directions: The authors believe current alignment methods are insufficient to address traditional Web threats and suggest future work on minimizing capability authorization, structured trust annotations for web pages, and architecture-level security mediation mechanisms to rebuild agentic browsers.