MUZZLE: An Adaptive Agent Red-Teaming Framework for Indirect Prompt Injection Attacks on Web Agents

The researchers propose MUZZLE, an automated agent red-teaming framework for evaluating Web Agents against indirect prompt injection attacks. The framework uses the agent's execution traces to automatically identify high-salience injection surfaces, adaptively generates context-relevant malicious instructions targeting confidentiality, integrity, and availability, and iteratively refines attacks based on feedback from failed executions. The researchers evaluate the framework across various web applications, user tasks, and agent configurations, reporting that it discovers 44 new attacks across 4 web applications, covering 10 adversarial goals, involving different LLMs and agent scaffolds, and also identifies 3 cross-application prompt injection attacks and a phishing scenario tailored to agents.