Pith. sign in

REVIEW 5 major objections 6 minor 2 cited by

Context manipulation attacks : Web agents are susceptible to corrupted memory

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Plan injection corrupts web agents' stored plans and bypasses prompt-injection defenses.

desk verdict Plan injection is a real and under-tested attack surface, but the headline 3x claim is not verifiable as written and the threat model in Section 4.1 contradicts the evaluated attacks. read the letter →

arxiv 2506.17318 v1 pith:L6ZUV63S submitted 2025-06-18 cs.CR cs.AI

Atharv Singh Patlan , Ashwin Hebbar , Pramod Viswanath , Prateek Mittal This is my paper · ORCID
classification cs.CRcs.AI
keywords contextmanipulationplaninjectionpromptwebagentsecuritymemoryprivacyexfiltrationBrowser-useAgent-E
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces and formalizes 'plan injection,' a context manipulation attack that corrupts the stored task plan a web navigation agent uses to decide its next actions. The authors argue that this attack bypasses prompt-injection defenses, achieving attack success rates up to three times higher than equivalent prompt-based attacks on two open-source agents, Browser-use and Agent-E. They also show that 'context-chained injections,' which weave attacker goals into a logical continuation of the user's task, raise privacy-exfiltration success by 17.7%. If these results hold, securing agent memory—not just filtering retrieved web content—becomes a necessary part of building trustworthy web agents.

What carries the argument

The load-bearing mechanism is the plan, the high-level subtask sequence that a hierarchical planner agent generates and then re-reads at every step to decide the next browser action. Plan injection writes a bounded perturbation $\delta_P$ into this plan ($c^* = (p_i, d_{i,t}, k, h_{i,t}, P_i \oplus \delta_P)$), so the malicious content is treated by the agent as its own prior reasoning rather than as external instruction. The paper's analysis of semantic embeddings shows that context-chained injections succeed because they balance similarity to the user's task and to the attacker's objective, exploiting the planner's inability to distinguish legitimate plan extensions from unauthorized ones.

What would settle it

A deployment of Browser-use or Agent-E that stores plans in an authenticated, integrity-protected memory would falsify the practical claim if plan injections then succeed at a rate no higher than prompt injection under the same benchmark. Alternatively, a reproduction that matches prompt injection and plan injection for semantic alignment and finds no success-rate gap would falsify the claim that plan injection offers a distinct advantage over prompt-based attacks.

Watch

Extended reading notes

Core claim

The paper's central claim is that web navigation agents remain exploitable even when standard prompt-injection defenses are deployed, because attackers can corrupt the agent's internal task representation rather than its inputs. Concretely, for a planner-based agent like Agent-E, the planner maintains a plan $P_i$ that is part of the context; by injecting malicious steps into that plan, an attacker can steer the agent toward unauthorized actions. On the WebVoyager-Privacy benchmark, a single plan injection at the initial planning stage achieved 46% full privacy-exfiltration success on Agent-E and 63% on Browser-use while equivalent prompt injections were driven below 20% by the SANDWICH and SECURE defenses. The paper further claims that task-aligned and context-chained injections beat non-contextual ones because they sit in a semantic region that is both close to the user's goal and aligned with the attacker's objective, making them hard for the planner to reject.

Load-bearing premise

The central claim rests on the assumption that an attacker can write directly into the agent's stored plan or memory—an access the paper motivates with insecure client-side storage and third-party services but does not demonstrate against the evaluated agents' actual deployments.

Editorial extensions

If this is right

  • Prompt-injection defenses such as SANDWICH and SECURE are insufficient on their own: a single corrupted plan still exfiltrates private data in 46% of Agent-E runs and 63% of Browser-use runs.
  • Subjective or opinion-based tasks are far more vulnerable than factual ones, with task-aligned plan injections reaching 94.7% success on opinion tasks versus 18.7% on factual tasks.
  • Hierarchical architectures with separate planning and execution layers are more resistant to generic injections but remain vulnerable to context-chained injections, so their security boundary is weaker than it appears.
  • Attack success depends on semantic alignment rather than the mere presence of malicious content, implying that defenses must check plan consistency against user intent instead of only filtering instruction-like text.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If plan injection transfers to production web agents that store plans in client-side or third-party memory, the practical attack surface includes any agent whose memory files can be written by a compromised extension or cloud service; the paper does not demonstrate such write access against the actual Browser-use and Agent-E deployments.
  • The semantic-balance finding suggests a testable design principle: a plan-validation module could compare embedding similarity between proposed plan steps and the user's original instruction, flagging steps whose alignment with the user goal is weak, which would directly test the paper's mechanism.
  • Because the paper uses GPT-4o as the planner for both agents, its own results imply that stronger reasoning models may reduce but not eliminate plan injection, and the paper names this as future work.
  • For neighboring agents with persistent task memory—customer-support agents, coding agents, or other computer-use agents—the same attack pattern may apply, and the 17.7% gain from context-chaining suggests logical bridges are a general amplifier for memory-based attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper formalizes "plan injection" as a context-manipulation attack on web navigation agents, in which an adversary corrupts the stored task plan used by a planner component. It evaluates the attack against Browser-use and Agent-E, with and without SANDWICH and SECURE prompt-injection defenses, using a self-generated Plan Injection Benchmark and a WebVoyager-Privacy benchmark. The paper reports that plan injections bypass these defenses, achieving up to 3x higher attack success rates than comparable prompt-based attacks, and that context-chained injections improve privacy-exfiltration success by 17.7%. The authors conclude that memory/context integrity must be a first-class security concern in agent architectures.

Significance. The central effect is plausible and potentially important: if an attacker can corrupt the planner state, prompt-level defenses such as SANDWICH and SECURE cannot be expected to stop the resulting behavior. The paper provides a useful hierarchy of injection sophistication (non-contextual, task-aligned, context-chained) and evaluates it on two real open-source agents and a real web benchmark. The strongest points are the external-validity design choices: real agents, real websites, and a task set derived from WebVoyager. The main weaknesses are that practical access to the planner state is not demonstrated for the evaluated deployments, and two headline quantitative claims are not supported by numbers in the text. With those gaps filled, the paper would be a valuable contribution to the security of agentic memory systems.

major comments (5)
  1. [3.2, Eq. (6); 4.1, Constraint 4] Equation (6) defines plan injection as c* = (p_i, d_i,t, k, h_i,t, P_i ⊕ δ_P), i.e., the manipulated component is the plan P_i. Section 4.1, Constraint 4, however, states that the attacker "can only inject content δ_h into the stored context h_t." If P_i is not contained in h_t, the evaluated attacks exceed the stated threat model; if it is, the formal context tuple should be collapsed or redefined so that the plan is a subcomponent of h_t. Please reconcile this discrepancy and specify exactly which agent state (file, database, variable) corresponds to P_i in Browser-use and Agent-E.
  2. [Abstract; 6.2] The headline claim of "up to 3x higher attack success rates" than comparable prompt-based attacks cannot be verified from the manuscript, because the defended prompt-injection ASR baselines are never given numerically. Section 6.2 states only that SANDWICH and SECURE "dramatically reduced vulnerability" to weak and strong prompt injection; no defended PI numbers appear in the text or tables, and Figure 5 is not accompanied by the underlying values. Report the full ASR matrix (PI-Weak, PI-Strong, and context injection, each with and without defenses) and the calculation of the 3x ratio.
  3. [Abstract; 6.2] The abstract's stated "17.7% increase" in success rate for privacy exfiltration from context-chained injections is not reported anywhere in Section 6 or in any table. Either the figure is missing from the results, or it is implied by Figure 6 differences (e.g., 63% vs. 45.3% on Browser-use), in which case the baseline, the agent, and the definition of "increase" should be stated explicitly.
  4. [4.1; 3.2] The threat model assumes the attacker can write to the stored plan P_i, but the paper does not demonstrate such write access for the actual Browser-use or Agent-E deployments. The cited precedents (the DeepSeek ClickHouse exposure and the ElizaOS attack) involve exposure of chat history in external stores, not the planner context of these two agents; the authors argue by analogy rather than by inspecting the storage locations, permissions, or integration paths in the evaluated systems. Please either demonstrate a concrete compromise path (e.g., where the plan is persisted, what client-side application or extension can modify it, or which third-party service stores it) or explicitly reframe the result as a conditional vulnerability: if an adversary can write to P_i, then the following ASR values hold.
  5. [4.3; 6.2] The abstract says plan injections affect both Browser-use and Agent-E, but Section 4.3 states that Browser-use "lack[s] an explicit planning layer" and is vulnerable to "naive memory injections," not plan injections. The paper should clarify whether the Browser-use results in Figures 5-6 are plan injections into a stored plan, memory injections into h_t, or a mixture, and should adjust the claims so that each attack name matches the component of the context it actually modifies.
minor comments (6)
  1. [Abstract] There are grammatical and typographical errors: "upto" should be "up to," and the phrase "17.7% increase attack success rate" is missing the word "in."
  2. [5.1; Figure 3] The paper reports ASR point estimates over five runs per sample, but it does not provide confidence intervals or per-run variance; such intervals would strengthen the cross-category comparisons.
  3. [5.2; Figure 4] The semantic-similarity analysis in Figure 4 is based only on "the first 20% tasks" of the WebVoyager-Privacy dataset; please state why this subset is representative and provide the same analysis for the full set.
  4. [4.2] The exact SANDWICH and SECURE defense prompts should be included in an appendix, since the strength of these defenses directly determines the meaning of the word "bypass."
  5. [5.1; 5.3] The benchmark artifacts, including the GPT-4o generation template and the per-sample evaluation criteria, should be provided with a persistent link; the footnote "The benchmarks are available at this link" does not contain a visible URL.
  6. [6.1; 6.2] Please report model versions, inference parameters, and the exact browser/agent software versions for the experiments to enable reproducibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the central attack-success claims are empirical measurements against external agents; the only self-citation supplies the formal notation, not the result.

full rationale

The paper's claimed derivation chain does not reduce to its inputs at the equation level. Section 3.2 defines plan injection as a modification of the planner state P_i (Eq. 6), and Sections 5-6 measure attack success rates empirically on two external agents (Browser-use and Agent-E) and on WebVoyager-derived tasks; no parameter is fitted and then relabeled as a prediction. The 'bypasses prompt injection defenses' statement is consistent with the attack definition: SANDWICH and SECURE defenses are applied to retrieved data and system prompts, while plan injection modifies the separate plan component; this is a scope observation, not a circular derivation, though it does mean the comparison is partially by construction. The one genuinely load-bearing gap is non-circular: Section 4.1's threat-model constraint 4 restricts the attacker to injecting δ_h into h_t, while Eq. 6 and the experiments modify P_i, and no demonstration is given that a realistic adversary can write to P_i in actual Browser-use/Agent-E deployments; this is an unproven premise and a feasibility/correctness risk, not an equation-level equivalence. The formalization is attributed to the authors' prior work (Patlan et al. 2025a,b), but the central empirical claims are evaluated against external systems and datasets, so the self-citation is not load-bearing. Defended prompt-injection ASR baselines are not reported in the text, making the 3x claim unverifiable as stated, but that is missing evidence rather than circularity. Overall: no circular step; score 1 reflects only minor self-citation and the notation/threat-model inconsistency.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The evaluation contains no fitted free parameters; the paper reports measured success rates. The attack framework relies on the agent-context abstraction and the assumed attacker write access, plus self-defined benchmarks and defenses. No new physical or theoretical entities are introduced; plan injection is an attack technique, not a postulated entity.

assumptions (5)
  • domain assumption Agents are stateless and maintain context as c_t = (p_t, d_t, k, h_t), with decisions sampled as argmax over actions.
    The context manipulation formalization in Section 3.1 is adopted from the authors' prior work (Patlan et al. 2025b) without independent validation.
  • domain assumption The attacker can modify the stored context or plan P_i without modifying the user prompt or browser data.
    Threat model in Section 4.1; feasibility is argued through client-side storage, third-party cloud providers, and compromised extensions, but no concrete write primitive is demonstrated for the tested agents.
  • ad hoc to paper SANDWICH and SECURE defenses provide a robust prompt-injection baseline.
    Section 4.2 introduces these defenses as baseline; the paper itself notes comprehensive prompt-injection defenses remain unsolved, so calling them robust overstates their strength.
  • ad hoc to paper The self-generated Plan Injection Benchmark and author-defined success criteria validly measure attack success.
    Sections 5.1 and 5.3: benchmarks are generated semi-automatically with GPT-4o, and success is judged by the authors' criteria without reported human validation; the adaptive injection also uses an LLM, which may correlate with the target model.
  • domain assumption Results on 45 WebVoyager-Privacy tasks and 15 samples per category generalize to real web-agent deployments.
    Small sample size, single model family (GPT-4o), headless mode, and no confidence intervals limit generalizability; this is an unstated generalization assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Context manipulation attacks : Web agents are susceptible to corrupted memory." pith.science (2026). https://pith.science/paper/L6ZUV63S

@misc{pith2026250617318,
  author       = {Pith},
  title        = {Pith review of: Context manipulation attacks : Web agents are susceptible to corrupted memory},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L6ZUV63S}},
  note         = {Machine review of arXiv:2506.17318}
}
read the original abstract

Autonomous web navigation agents, which translate natural language instructions into sequences of browser actions, are increasingly deployed for complex tasks across e-commerce, information retrieval, and content discovery. Due to the stateless nature of large language models (LLMs), these agents rely heavily on external memory systems to maintain context across interactions. Unlike centralized systems where context is securely stored server-side, agent memory is often managed client-side or by third-party applications, creating significant security vulnerabilities. This was recently exploited to attack production systems. We introduce and formalize "plan injection," a novel context manipulation attack that corrupts these agents' internal task representations by targeting this vulnerable context. Through systematic evaluation of two popular web agents, Browser-use and Agent-E, we show that plan injections bypass robust prompt injection defenses, achieving up to 3x higher attack success rates than comparable prompt-based attacks. Furthermore, "context-chained injections," which craft logical bridges between legitimate user goals and attacker objectives, lead to a 17.7% increase in success rate for privacy exfiltration tasks. Our findings highlight that secure memory handling must be a first-class concern in agentic systems.

Figures

Figures reproduced from arXiv: 2506.17318 by the authors.

Figure 1
Figure 1. A Plan injection attack to leak user’s private data. A carefully crafted plan injection (in red) related to both the user’s and attacker’s objective is used. ager leaderboard (Steel.dev, 2024)), whose architectures exemplify current approaches in this domain. Browser-use uses a controller agent to decide on the single next step to take by referencing the user’s goal as well as cur￾rent and past execution trajectory … view at source ↗
Figure 2
Figure 2. The information flow and context manipulation attack vector of the agent system. Context manipulation via Memory Injection (MI). This attack vector manipulates the agent’s stored interaction his￾tory: c ∗ = (pt, dt, k, ht ⊕ δh) (4) Memory injection operates through two primary mecha￾nisms: • Direct memory injection modifies backend storage such as conversation logs or state files. While this might initially seem to … view at source ↗
Figure 4
Figure 4. Context-chained injections (orange) achieve an optimal balance between similarity to user tasks (x-axis) and attacker ob￾jectives (y-axis), explaining their higher success rates compared to task-aligned injections and non-contextual injections. This visual￾ization is based on the first 20% tasks of the WebVoyager-privacy dataset. tasks, 35.6% for privacy tasks) by establishing thematic rel￾evance; for example, sugge… view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Attack success rates for different attack vectors across security configurations on the WebVoyager benchmark. PI-Weak: Inject into a single retrieval, PI-Strong: Inject at every retrieval step, CI: Single plan injection. Partial success indicates attacker tool access, …
Figure 6
Figure 6. Figure 6: Comparison of injection sophistication levels on Agent-E and Browser-use. Context-chained injections clearly outperform the other levels [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents

    cs.CR 2026-07 conditional novelty 7.0 of 10

    A trained attack model generates single emails that silently inject false memories into persistent AI agents, achieving 87.5% end-to-end success on GPT-5.4 and transferring across architectures and memory backends.

  2. MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents

    cs.AI 2026-08 conditional novelty 6.0 of 10

    MAFIA poisons RAG agent memory through probing and compact factual cloaks, reaching up to 90.7% attack success while evading low-FPR input audits.

Reference graph

Works this paper leans on

27 extracted references · 2 canonical work pages · cited by 2 Pith papers

  1. [1]

    Agent-e: From autonomous web navigation to foundational design principles in agentic systems.arXiv preprint arXiv:2407.13032,

    Abuelsaad, T., Akkil, D., Dey, P., Jagmohan, A., Vempaty, A., and Kokku, R. Agent-e: From autonomous web navigation to foundational design principles in agentic systems.arXiv preprint arXiv:2407.13032,

    arXiv

  2. [5]

    Defeating prompt injections by design.arXiv preprint arXiv:2503.18813,

    Debenedetti, E., Shumailov, I., Fan, T., Hayes, J., Carlini, N., Fabian, D., Kern, C., Shi, C., Terzis, A., and Tram`er, F. Defeating prompt injections by design.arXiv preprint arXiv:2503.18813,

    arXiv

  3. [6]

    A practical memory injection attack against llm agents.arXiv preprint arXiv:2503.03704,

    Dong, S., Xu, S., He, P., Li, Y ., Tang, J., Liu, T., Liu, H., and Xiang, Z. A practical memory injection attack against llm agents.arXiv preprint arXiv:2503.03704,

    arXiv

  4. [8]

    Defending against indirect prompt injection attacks with spotlighting.arXiv preprint arXiv:2403.14720,

    Hines, K., Lopez, G., Hall, M., Zarfati, F., Zunger, Y ., and Kiciman, E. Defending against indirect prompt injection attacks with spotlighting.arXiv preprint arXiv:2403.14720,

    arXiv

  5. [9]

    M., Maxwell, T., Cheng, N., et al

    Hubinger, E., Denison, C., Mu, J., Lambert, M., Tong, M., MacDiarmid, M., Lanham, T., Ziegler, D. M., Maxwell, T., Cheng, N., et al. Sleeper agents: Training deceptive llms that persist through safety training.arXiv preprint arXiv:2401.05566,

    arXiv

  6. [10]

    R., Chang, E., Robinson, V ., Hendryx, S., Zhou, S., Fredrik- son, M., et al

    Kumar, P., Lau, E., Vijayakumar, S., Trinh, T., Team, S. R., Chang, E., Robinson, V ., Hendryx, S., Zhou, S., Fredrik- son, M., et al. Refusal-trained llms are easily jailbroken as browser agents.arXiv preprint arXiv:2410.13886,

    arXiv

  7. [11]

    L., Sun, J., Wang, J., et al

    Liu, X., Qin, B., Liang, D., Dong, G., Lai, H., Zhang, H., Zhao, H., Iong, I. L., Sun, J., Wang, J., et al. Autoglm: Autonomous foundation agents for guis.arXiv preprint arXiv:2411.00820, 2024a. Liu, Y ., Jia, Y ., Geng, R., Jia, J., and Gong, N. Z. For- malizing and benchmarking prompt injection attacks and defenses. In33rd USENIX Security Symposium (USE...

    arXiv

  8. [12]

    Accessed: 2025- 05-21

    URL https://manus.im. Accessed: 2025- 05-21. Muller, M. and Zunic, G. Browser-use: Ai-powered browser automation. https://github.com/ browser-use/browser-use,

    work page 2025

Show all 27 references
  1. [13]

    Nagli, G

    Accessed: 2025-05-21. Nagli, G. Wiz research uncovers exposed deepseek database leaking sensitive information, including chat history, January

    2025

  2. [14]

    Accessed: 2025-05-19

    URL https://www.wiz.io/blog/ wiz-research-uncovers-exposed-deepseek-database-leak . Accessed: 2025-05-19. Nakash, I., Kour, G., Uziel, G., and Anaby-Tavor, A. Break- ing react agents: Foot-in-the-door attack will get you in. arXiv preprint arXiv:2410.16950,

    2025 arXiv

  3. [15]

    URL https://owasp.org/ www-project-top-10-for-large-language-model-applications/ assets/PDF/OWASP-Top-10-for-LLMs-v2025. pdf. Patlan, A. S., Sheng, P., Hebbar, S. A., Mittal, P., and Viswanath, P. Ai agents in cryptoland: Practical attacks and no silver bullet.Cryptology ePrin...

    arXiv

  4. [16]

    Agent q: Advanced reasoning and learning for autonomous ai agents.arXiv preprint arXiv:2408.07199,

    Putta, P., Mills, E., Garg, N., Motwani, S., Finn, C., Garg, D., and Rafailov, R. Agent q: Advanced reasoning and learning for autonomous ai agents.arXiv preprint arXiv:2408.07199,

    arXiv

  5. [17]

    Shahbandeh, M., Alian, P., Nashid, N., and Mesbah, A

    [Accessed 12-03-2025]. Shahbandeh, M., Alian, P., Nashid, N., and Mesbah, A. Nav- iqate: Functionality-guided web application navigation. arXiv preprint arXiv:2409.10741,

    2025 arXiv

  6. [18]

    Scribeagent: Towards specialized web agents using production-scale workflow data.arXiv preprint arXiv:2411.15004,

    Shen, J., Jain, A., Xiao, Z., Amlekar, I., Hadji, M., Podolny, A., and Talwalkar, A. Scribeagent: Towards specialized web agents using production-scale workflow data.arXiv preprint arXiv:2411.15004,

    arXiv

  7. [19]

    Su, H., Sun, R., Yoon, J., Yin, P., Yu, T., and Arık, S

    Accessed: 2025- 04-13. Su, H., Sun, R., Yoon, J., Yin, P., Yu, T., and Arık, S. ¨O. Learn-by-interact: A data-centric framework for self- adaptive agents in realistic environments.arXiv preprint arXiv:2501.10893,

    2025 arXiv

  8. [20]

    R., Yao, S., Narasimhan, K., and Griffiths, T

    Sumers, T. R., Yao, S., Narasimhan, K., and Griffiths, T. L. Cognitive architectures for language agents.arXiv preprint arXiv:2309.02427,

    arXiv

  9. [21]

    F., Tang, X., Zhuge, M., Pan, J., Song, Y ., Li, B., Singh, J., et al

    Wang, X., Li, B., Song, Y ., Xu, F. F., Tang, X., Zhuge, M., Pan, J., Song, Y ., Li, B., Singh, J., et al. Openhands: An open platform for ai software developers as generalist agents.arXiv preprint arXiv:2407.16741,

    arXiv

  10. [22]

    H., Koh, J

    Wu, C. H., Koh, J. Y ., Salakhutdinov, R., Fried, D., and Raghunathan, A. Adversarial attacks on multimodal agents.arXiv preprint arXiv:2406.12814,

    arXiv

  11. [23]

    T., and Mittal, P

    Wu, T., Xiang, C., Wang, J. T., and Mittal, P. Effectively con- trolling reasoning models through thinking intervention. arXiv preprint arXiv:2503.24370,

    arXiv

  12. [24]

    Agentoccam: A sim- ple yet strong baseline for llm-based web agents.arXiv preprint arXiv:2410.13825,

    Yang, K., Liu, Y ., Chaudhary, S., Fakoor, R., Chaudhari, P., Karypis, G., and Rangwala, H. Agentoccam: A sim- ple yet strong baseline for llm-based web agents.arXiv preprint arXiv:2410.13825,

    arXiv

  13. [25]

    Benchmarking and defending against indirect prompt injection attacks on large language models.arXiv preprint arXiv:2312.14197,

    Yi, J., Xie, Y ., Zhu, B., Kiciman, E., Sun, G., Xie, X., and Wu, F. Benchmarking and defending against indirect prompt injection attacks on large language models.arXiv preprint arXiv:2312.14197,

    arXiv

  14. [26]

    Injeca- gent: Benchmarking indirect prompt injections in tool- integrated large language model agents.arXiv preprint arXiv:2403.02691,

    Zhan, Q., Liang, Z., Ying, Z., and Kang, D. Injeca- gent: Benchmarking indirect prompt injections in tool- integrated large language model agents.arXiv preprint arXiv:2403.02691,

    arXiv

  15. [27]

    Gpt-4v (ision) is a generalist web agent, if grounded.arXiv preprint arXiv:2401.01614,

    Zheng, B., Gou, B., Kil, J., Sun, H., and Su, Y . Gpt-4v (ision) is a generalist web agent, if grounded.arXiv preprint arXiv:2401.01614,

    arXiv

  16. [2022]

    Struq: De- fending against prompt injection with structured queries

    Chen, S., Piet, J., Sitawarin, C., and Wagner, D. Struq: De- fending against prompt injection with structured queries. arXiv preprint arXiv:2402.06363, 2024a. Chen, S., Zharmagambetov, A., Mahloujifar, S., Chaudhuri, K., and Guo, C. Aligning llms to be robust against prompt in...

    arXiv

  17. [2023]

    Webvoyager: Building an end-to-end web agent with large multimodal models.arXiv preprint arXiv:2401.13919,

    He, H., Yao, W., Ma, K., Yu, W., Dai, Y ., Zhang, H., Lan, Z., and Yu, D. Webvoyager: Building an end-to-end web agent with large multimodal models.arXiv preprint arXiv:2401.13919,

    arXiv

  18. [2024]

    Bai, Y ., Jones, A., Ndousse, K., Askell, A., Chen, A., Das- Sarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., et al

    Accessed: 2025-05-19. Bai, Y ., Jones, A., Ndousse, K., Askell, A., Chen, A., Das- Sarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., et al. Training a helpful and harmless assistant with rein- forcement learning from human feedback.arXiv preprint arXiv:2204.05862,

    2025 arXiv

  19. [2025]

    Agentdojo: A dynamic en- vironment to evaluate attacks and defenses for llm agents

    Debenedetti, E., Zhang, J., Balunovi´c, M., Beurer-Kellner, L., Fischer, M., and Tram`er, F. Agentdojo: A dynamic en- vironment to evaluate attacks and defenses for llm agents. arXiv preprint arXiv:2406.13352,

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.