Source-linked AI summary
WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
Ivan Evtimov, Arman Zharmagambetov, Aaron Grattafiori, Chuan Guo, Kamalika Chaudhuri
TL;DR
Web agents can be manipulated through prompt injections while acting on users’ behalf, and existing evaluations inadequately capture realistic, end-to-end risk. WASP introduces a public benchmark with constrained adversaries and realistic multi-step goals, finding frequent partial hijacking but much lower full attacker completion. Its current scope remains limited to two web environments and a non-diverse prompt set.
Problem
Existing web-agent prompt-injection evaluations often use unrealistic attacker assumptions or isolated tasks, limiting realistic end-to-end security measurement.
Method
WASP is a public, sandboxed benchmark that evaluates generalist agents against realistic black-box attackers with constrained webpage control and concrete multi-step goals.
Results
Up to 86% of attacks partially succeed, while attacker task completion ranges from 0 to 17%.
Takeaways & Limitations
End-to-end evaluation exposes security by incompetence: agents are often diverted but struggle to complete the attacker’s ultimate goal.
Takeaways & Limitations
WASP currently supports only Reddit and GitLab and lacks a diverse set of prompt-injection attack prompts.
Abstract
from arXiv · showhide
Autonomous UI agents powered by AI have tremendous potential to boost human productivity by automating routine tasks such as filing taxes and paying bills. However, a major challenge in unlocking their full potential is security, which is exacerbated by the agent's ability to take action on their user's behalf. Existing tests for prompt injections in web agents either over-simplify the threat by testing unrealistic scenarios or giving the attacker too much power, or look at single-step isolated tasks. To more accurately measure progress for secure web agents, we introduce WASP -- a new publicly available benchmark for end-to-end evaluation of Web Agent Security against Prompt injection attacks. Evaluating with WASP shows that even top-tier AI models, including those with advanced reasoning capabilities, can be deceived by simple, low-effort human-written injections in very realistic scenarios. Our end-to-end evaluation reveals a previously unobserved insight: while attacks partially succeed in up to 86% of the case, even state-of-the-art agents often struggle to fully complete the attacker goals -- highlighting the current state of security by incompetence.
1 Introduction
Web agents can take consequential actions for users, but existing prompt-injection evaluations often use unrealistic threat models or isolated steps. WASP addresses this gap with realistic, reproducible end-to-end testing and reveals frequent hijacking alongside incomplete attacker execution.
- Web-navigation agents can automate routine multi-step tasks, but their access to external environments exposes users to prompt-injection threats and material damage.
- Prior studies often simplify attacks through unrealistic goals, excessive attacker control, isolated steps, or narrow agent coverage, limiting practical insight.
- WASP is a dynamic, sandboxed benchmark for end-to-end Web Agent Security against Prompt injection attacks.
- Its design models adversarial website users with limited webpage control, no implementation knowledge, and concrete multi-step security goals.
- WASP evaluates attacks and task performance end to end in an isolated, controllable environment while supporting generalist web or computer agents and public reproducibility.
- Up to 86% of attacks partially succeed, yet attacker task completion ranges from 0 to 17%, revealing security by incompetence.
- Current execution limits may not persist as agentic systems and web platforms improve, increasing the need for effective defenses.
2 Background
WASP situates prompt injection within the broader security risks of tool-connected agents and proposes a benchmark focused on realistic adversaries and generalist web interaction. This contrasts with prior benchmarks that restrict tools, overpowered attackers, or incomplete success measures.
- AI agents connect language models to external APIs or web and computer interfaces, exposing them to attacks through external tools and environments.
- WASP’s threat model limits attackers to permitted webpage content, denies implementation knowledge, and requires well-defined multi-step adversarial goals.
- Earlier work established indirect prompt injection against text-only applications, while WASP extends the setting to complex web-navigation agents and realistic adversaries.
- Some prior agent studies assume attackers control the entire external environment, whereas more realistic attacks control only parts of a website.
- Existing benchmarks often target limited-tool agents rather than generalist web agents, and InjecAgent checks malicious API calls without measuring attacker-goal success.
3 WASP: A Benchmark for Web Agent Security
WASP combines realistic web environments, concrete attacker and user goals, prompt-injection templates, and rule-based end-to-end evaluation. It distinguishes diverting an agent from its user task from completing the attacker’s ultimate objective.
- WASP targets prompt-injection security risk when a benign user task and malicious environment prompt compete to direct a web agent.
- The benchmark uses GitLab and Reddit environments in VisualWebArena, with black-box attackers controlling only specific webpage elements.
- Attacker goals are manually constructed concrete security violations and verified achievable within the simulated web environment.
- Each test combines an attacker goal with a benign user goal, producing 42 scenarios and 84 tasks across two injection templates.
- Plain-text and URL templates direct agents toward malicious URLs and instructions, with task-agnostic variants for attackers lacking user-goal knowledge.
- ASR-end-to-end uses rule-based evaluators to determine whether each attacker goal’s specified final-state outcome was achieved.
- ASR-intermediate identifies partial success when an agent is diverted from its user goal but fails to complete the attacker goal, using an LLM judge over traces and actions.
- The 37-task utility set measures baseline agent performance on legitimate adversarial goals and common activities without attacks.
4 Experiments
WASP evaluates prompt-injection security and task performance for web agents across multiple models and agentic scaffoldings. The experiments show that agents are often hijacked at intermediate steps, but completing the attacker’s full multi-step objective remains substantially harder.
- Main results: 17–86% ASR-intermediate shows that agents were relatively easy to divert from their original tasks, whereas ASR-end-to-end reached only 16%.The authors attribute the gap partly to current agents’ limited capabilities.
- Experimental setup: VisualWebArena represents webpages with an accessibility tree and optionally an annotated screenshot, while agents select actions using numbered element identifiers.The scaffolding also retains the prior action, current view, URL, and original user objective.
- Experimental setup: The experiments report attack success rate and utility while varying model, scaffolding, webpage observation type, and defense mechanism.The primary findings use task-related prompts.
- Attack behavior: Many agents begin by following malicious instructions, but intermediate behavior often includes reverting to the user’s goal or taking irrelevant actions.The action-flow analysis groups behavior into the first action, merged intermediate actions, and final state.
- Attack behavior: As hijacked agents become more capable of reasoning about webpages and selecting elements, ASR-end-to-end increases, producing the paper’s “security through incompetence” phenomenon.The authors identify agent capability, rather than attack strength, as the main bottleneck for completing attacker goals.
5 Conclusion
WASP is an end-to-end benchmark for realistic prompt-injection attacks against autonomous web agents. It finds that hijacking is relatively easy, but completing attacker goals remains difficult because of agent limitations and complex objectives.
- WASP evaluates autonomous web-agent security using fully operational, self-hosted websites, realistic attacker and defender assumptions, and complex security-violation goals.
- The benchmark supports dynamic evaluation of emerging prompt-injection attacks and mitigation strategies.
- Agents are relatively easy to hijack from their original objectives, while current mitigation techniques remain insufficient to prevent this.
- Completing attackers’ ultimate goals is significantly more difficult because of agent capability limitations and the complexity of those goals.
- Limitations and future work: WASP currently supports only Reddit and GitLab, lacks diverse injection prompts, and has not yet been extended to desktop or code agents.
A Additional Related Work
Prior work studies language-model and web-agent vulnerabilities, defenses, and indirect prompt injections, but relevant methods and threat models remain varied. This work situates WASP within research on agent scaffolding, web navigation, attacks, and defenses.
- AI agents: Web-navigation agents use website representations such as HTML, accessibility trees, or screenshots, alongside browser backends and language-model backbones to choose actions.
- Prompt injection attacks and defenses: Prompt-injection research includes attacks that place adversarial instructions in external content encountered by language models integrated into broader systems.
- Prompt injection attacks and defenses: Defense strategies include attack-warning instructions, system-level data-flow controls, and model-based methods.
B Additional Tables and Figures
The supplementary material documents attacker goals, utility tasks, attack prompts, defensive prompts, and examples used to evaluate intermediate compromise and agent behavior. It also includes task and reasoning exemplars for labeling compromise, recovery, confusion, and refusal.
- Table 5 compiles attacker goals and their corresponding categories of security violation.
- The utility evaluation combines attacker goals presented as legitimate requests with common GitLab and Reddit activities.
- The supplementary examples distinguish compromised reasoning from recovery, non-compromise, and outright refusal.
- Attack templates include task-agnostic plain-text and URL injections that instruct agents to visit specified URLs or click injected links.
- The defensive system prompt instructs agents to disregard webpage instructions that conflict with the legitimate user objective.
- The evaluator labels whether an agent’s reasoning and action pursue the adversarial goal, the legitimate goal, or neither.
NeurIPS Paper Checklist
The checklist records the paper’s benchmark scope, reproducibility information, ethical safeguards, and documentation. It states that the experiments use cloud-hosted models whose providers do not disclose certain compute details.
- The paper claims its main contributions and benchmark results are accurately reflected and publicly supported by released code and stated inference platforms.
- The authors state that limitations are discussed in the Conclusion’s “Limitations and future work” section.
- The benchmark has no theoretical results because it is an empirical benchmark paper.
- The experiments use 84 user-request and prompt-injection combinations for ASR metrics and 37 prompts for the Utility metric.
- The paper reports testing cloud-hosted GPT-4o, o1, and Claude models, whose providers do not disclose compute-worker, memory, and execution-time details.
- The work uses self-hosted environments without real users and involves no human subjects.