ceLLMate: A Sandbox Framework for Browser AI Agents

To address the problem that browser-use agents (BUA) are easily induced by prompt injection attacks to leak private information or issue unexpected state-change requests, the paper proposes a browser-layer sandbox framework, ceLLMate, which narrows the scope of prompt injection by restricting the agent's ambient authority. Its core idea is to enforce the sandbox at the HTTP layer, because all UI operations with side effects ultimately produce network communication to website backends, thereby avoiding the fragile and error-prone semantic gap of writing and executing security policies for low-level UI tools such as clicks and keystrokes. ceLLMate is implemented as an agent-agnostic browser extension, and the paper shows that its sandbox policy can block prompt injection attacks on the WASP benchmark, with a latency overhead of 7.25%–15%.