The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named
cs.CR
Submitted: 2026-10-10
Updated: 2026-10-10
Comments: 12 pages, 4 figures
Code: https://github.com/browser-use/browser-use
Project page: https://wsp-lab.github.io/papers/lee-sp26.pdf
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Sources
- WebArena: A Realistic Web Environment for Building Autonomous Agents
- Same-Origin Policy for Agentic Browsers
- WAAA! Web Adversaries Against Agentic Browsers
- Failure-Transparent Agents: Benchmarking Post-Failure Reporting in Tool-Using Language Models
- From Confident Closing to Silent Failure: Characterizing False Success in LLM Agents
- Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices
- Delegated Authorization for Agents Constrained to Semantic Task-to-Scope Matching
- Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world
- ceLLMate: Sandboxing Browser AI Agents
- Ignore Previous Prompt: Attack Techniques For Language Models
- Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
- AI Agents May Always Fall for Prompt Injections
- EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
- The Hidden Dangers of Browsing AI Agents
- LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents
- VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
- RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments
- Visual Confused Deputy: Exploiting and Defending Perception Failures in Computer-Using Agents
- Investigating the Impact of Dark Patterns on LLM-Based Web Agents
- What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills