AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
Sarim Hashmi , Mukul Ranjan , Kshitij Mishra , Mikhail Kuznetsov , Praneeth Vepakomma , Nils Lukas
- 🏛 Institutions
- MBZUAI , Amazon , MIT
- 📅 Date
- October 6, 2026
- 📑 Publisher
- arXiv
- 💻 Env
- Web
- 🔑 Keywords
TLDR
Proposes AdvSim2Real, an adversarial simulation framework that trains web agents against adaptive indirect prompt injection within a web world model sandbox. Pre-training agents against simulated adversarial web pages significantly reduces injection vulnerability on live web benchmarks without harming benign navigation success.
Related papers (24)
- WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web AgentsFebruary 3, 2026 · arXiv
- SkillLifeBench: Benchmarking Security Across the Lifecycle of Agent SkillsOctober 26, 2026 · arXiv
- SPIDES: Information-Flow Control for Browser AgentsOctober 16, 2026 · arXiv
- What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web SemanticsOctober 15, 2026 · arXiv
- BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser ViewsOctober 12, 2026 · arXiv
- The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous AgentsSeptember 16, 2026 · arXiv
- Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection GuardrailsSeptember 2, 2026 · arXiv
- WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM AgentsAugust 25, 2026 · arXiv
- Dual-Modality Multi-Stage Adversarial Safety Training: Robustifying Multimodal Web Agents Against Cross-Modal AttacksMarch 4, 2026 · arXiv
- WebInject: Prompt Injection Attack to Web AgentsMay 16, 2025 · EMNLP 2025 (Poster)
- WASP: Benchmarking Web Agent Security Against Prompt Injection AttacksApril 22, 2025 · NeurIPS 2025 (Poster)
- MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency InjectionOctober 16, 2026 · arXiv
- MMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationOctober 14, 2026 · arXiv
- AgentHijack: Visual Patch Attacks on Multimodal Computer-Use AgentsSeptember 6, 2026 · arXiv
- SIR: Self-improving Red-teaming for Compute Use AgentsAugust 31, 2026 · arXiv
- InterA11y: Interactive Web Accessibility Error Detection with LLM AgentsOctober 29, 2026 · arXiv
- AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access BarriersOctober 29, 2026 · arXiv
- WebAnything: From the Wild Web to Scalable Agent EnvironmentsOctober 27, 2026 · arXiv
- Back to Basics: A Skill-Centric Approach to Generalist Web AgentsOctober 26, 2026 · arXiv
- AgentProofBench: Benchmarking Reusable Verifiers for Web AgentsOctober 25, 2026 · arXiv
- SkillShift-Bench: Benchmarking Skill Learning under Environment Evolution for Web AgentsOctober 24, 2026 · arXiv
- Learning What to Ask for Tomorrow: Active Preference Acquisition for Long-Term Personalized Web AgentsOctober 22, 2026 · arXiv
- Step-Aligned Script Generation with Verification and Recovery for Web Automation TestingOctober 19, 2026 · arXiv
- LoWAgent: A Low-Resource Multilingual Benchmark for Web AgentsOctober 19, 2026 · arXiv