AgentBreaker: Evaluating Context-Aware Indirect Prompt Injection Risks in Modern Web Agents

AgentBreaker is an indirect prompt injection attack framework that composes adversarial phrases tailored to page-specific context and embeds them as HTML elements that web agents process, inducing actions such as clicking attacker-designated elements, posting attacker-provided text, and disclosing internal agent secrets. It reaches attack success rates of 71.7%-100% against five web agents on 60 Online-Mind2Web pages, and the proposed defenses lower the rate to 1.7%.

• Towards Safe Autonomy for Computer Use
  October 13, 2026 · arXiv
• The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named
  October 10, 2026 · arXiv
• Securing Computer-Use Agents Against Branch Steering Attacks
  October 2, 2026 · NeurIPS 2026 Workshop on Agents in the Wild
• LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents
  August 5, 2026 · arXiv
• RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments
  May 28, 2025 · ICLR 2026 (Oral)
• Preference Redirection via Attention Concentration: An Attack on Computer Use Agents
  April 9, 2026 · arXiv
• Zero-Permission Manipulation: Can We Trust Large Multimodal Model Powered GUI Agents?
  January 18, 2026 · arXiv
• VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
  June 3, 2025 · ICLR 2026 (Poster)
• SkillLifeBench: Benchmarking Security Across the Lifecycle of Agent Skills
  October 26, 2026 · arXiv
• SPIDES: Information-Flow Control for Browser Agents
  October 16, 2026 · arXiv
• What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics
  October 15, 2026 · arXiv
• PrivacyGuard: Source-Linked Sanitization and Locally Resolvable PII References for Cloud GUI Agents
  October 12, 2026 · arXiv
• BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views
  October 12, 2026 · arXiv
• Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents
  October 7, 2026 · arXiv
• AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
  October 6, 2026 · arXiv
• The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
  September 16, 2026 · arXiv
• Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails
  September 2, 2026 · arXiv
• WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents
  August 25, 2026 · arXiv
• StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection
  August 6, 2026 · arXiv
• WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks
  April 7, 2026 · arXiv
• Dual-Modality Multi-Stage Adversarial Safety Training: Robustifying Multimodal Web Agents Against Cross-Modal Attacks
  March 4, 2026 · arXiv
• Next-Gen CAPTCHAs: Leveraging the Cognitive Gap for Scalable and Diverse GUI-Agent Defense
  February 9, 2026 · ICML 2026
• WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents
  February 3, 2026 · arXiv
• Avenir-Web: Human-Experience-Imitating Multimodal Web Agents with Mixture of Grounding Experts
  February 2, 2026 · arXiv