In-Browser LLM-Guided Fuzzing for Real-Time Prompt Injection Testing in Agentic AI Browsers

This paper studies prompt-injection testing for agentic AI browsers with an LLM-guided fuzzing loop that runs inside a real browser and mutates malicious pages using immediate attack feedback. It reports that simple attacks are usually blocked, but adaptive mutations drive failure rates to 58-74% by the tenth iteration, with page summarization and question-answering features showing the highest risk.

• SPIDES: Information-Flow Control for Browser Agents
  October 16, 2026 · arXiv
• What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics
  October 15, 2026 · arXiv
• BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views
  October 12, 2026 · arXiv
• AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
  October 6, 2026 · arXiv
• The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
  September 16, 2026 · arXiv
• Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails
  September 2, 2026 · arXiv
• WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents
  August 25, 2026 · arXiv
• WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents
  February 3, 2026 · arXiv
• It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents
  December 29, 2025 · arXiv
• Genesis: Evolving Attack Strategies for LLM Web Agent Red-Teaming
  October 21, 2025 · ICME 2026
• WebInject: Prompt Injection Attack to Web Agents
  May 16, 2025 · EMNLP 2025 (Poster)
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
  April 22, 2025 · NeurIPS 2025 (Poster)
• EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
  September 17, 2024 · ICLR 2025 (Poster)
• MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection
  October 16, 2026 · arXiv
• MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation
  October 14, 2026 · arXiv
• AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents
  September 6, 2026 · arXiv
• SIR: Self-improving Red-teaming for Compute Use Agents
  August 31, 2026 · arXiv
• Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System
  February 11, 2026 · arXiv
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents
  January 14, 2026 · arXiv
• MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control
  October 23, 2024 · arXiv
• What Does "Now" Mean to Your Computer-Use Agent? Stale Screenshots, Page Loads, and Which Check to Run Before a Click
  October 29, 2026 · arXiv
• InterA11y: Interactive Web Accessibility Error Detection with LLM Agents
  October 29, 2026 · arXiv
• AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers
  October 29, 2026 · arXiv
• WebAnything: From the Wild Web to Scalable Agent Environments
  October 27, 2026 · arXiv