Who Pays the Price? A Stakeholder-Centered Prompt Injection Benchmark for Real-World Web Agents

The researchers propose StakeBench, a stakeholder-centered prompt injection benchmark for evaluating LLM web agents in real online shopping scenarios. Such agents extensively encounter untrusted web content when performing operations with direct financial consequences, while existing safety benchmarks adopt an attack-centered perspective, focusing only on the technical feasibility of injection and ignoring the distribution of harm among different stakeholders. StakeBench decomposes prompt injection risk into 12 attack objectives under 3 categories of stakeholders, instantiates them with 22 reusable templates into 264 executable adversarial cases covering 12 product categories, and evaluates at both the outcome and process levels. An evaluation of 3,168 attack runs across 4 deployable agent backbone configurations shows that existing LLM web agents reliably resist none of the attack objectives, and attack outcomes exhibit 4 qualitatively different patterns; such differences in harm distribution are ignored by attack-centered single-metric evaluations.