PaperlayerView exact revision on arXiv

Source-linked AI summary

Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond

Nivedita Singh, Alsharif Abuadbba, Yansong Gao, Surya Nepal, Hyoungshick Kim

arXiv:2609.03999v1cs.CY

TL;DR

LLM integration creates a gap between traditional web-security models and dynamic, cross-layer threats such as prompt injection and amplified legacy vulnerabilities. This survey unifies web and LLM security analysis across application layers, evaluates defenses and frameworks, and concludes that LLM-mediated interactions weaken trust and execution boundaries in ways existing frameworks do not fully model.

  • Problem

    Existing security analyses do not systematically connect LLM-specific threats with full-stack web vulnerabilities or adequately model adversarial natural-language, agent-driven, and post-deployment risks.

  • Method

    The survey maps LLM-related threats to the OWASP LLM Top 10 across client-side, server-side, and pipeline layers while examining extensions to security frameworks.

  • Results

    LLM-mediated interactions weaken data–instruction, trust, and execution boundaries, creating a dynamic, interaction-driven web threat landscape.

  • Takeaways & Limitations

    Secure LLM-enabled web systems require a unified perspective that accounts for interactions among traditional web threats, LLM-native risks, and interconnected application layers.

  • Takeaways & Limitations

    Existing frameworks lack the ability to model adversarial natural-language manipulation, agent-driven behaviors, and post-deployment risks.

Abstract

from arXiv · show

Large language models (LLMs) are becoming integral to web applications and browser agents, transforming online interactions while introducing new attack vectors and reshaping longstanding web vulnerabilities. Classical threats such as cross-site scripting (XSS) can be amplified through LLM-mediated interactions, while LLM-specific vulnerabilities can propagate across web applications, introducing attacks such as prompt injection. Securing modern web systems therefore requires understanding interactions between traditional and LLM-specific threats across the system lifecycle. Unlike prior surveys treating web and LLM security separately, this survey provides a unified analysis of how LLMs amplify web vulnerabilities across client-side, server-side, and pipeline layers while evaluating defenses and their limitations. The analysis examines extending NIST and ISO/IEC AI security frameworks to the security needs of LLM-enabled web environments. Three unresolved challenges are identified: adversarial natural-language instructions, autonomous agent security, and post-deployment security through continuous monitoring and adaptation. An LLM-aware monitoring and control framework is proposed, integrating semantic input validation, prompt integrity protection, output isolation, agent governance, and runtime monitoring. This unified perspective characterizes the evolving threat landscape and outlines future directions for secure AI-enabled web systems.

1 Introduction

LLMs reshape web security by amplifying traditional vulnerabilities, introducing new attack paradigms, and propagating risks across client, server, and pipeline layers. This survey connects these threats to full-stack attack models, defenses, and security-framework extensions.

  • Threat Landscape: LLM-mediated interactions amplify and transform legacy threats such as XSS and CSRF while expanding the web attack surface.Prompt injection, agent-executed adversarial instructions, membership inference, jailbreaking, and model inversion add new attack paradigms.
  • Full-Stack Scope: Backend weaknesses can propagate into client-side privacy harms, so LLM vulnerabilities must be analyzed across the client interface, model, vector database, retrieval API, and application logic.The paper grounds this claim in excessive data exposure and embedding-pipeline inversion attacks.
  • Research Gap: The survey addresses the gap between LLM-specific security studies and concrete full-stack web attack models and mitigation strategies.Its research questions examine how risks amplify traditional vulnerabilities and whether existing defenses and standards cover client-side, server-side, pipeline, and ecosystem layers.
  • Findings: The analysis finds that LLM integration re-enables XSS, CSRF, clickjacking, man-in-the-middle, request-hijacking, and session-hijacking risks while introducing prompt leakage, embedding inference, misinformation, and excessive agency.These novel risks fall outside conventional web-security frameworks.
  • Contributions: The paper contributes a taxonomy linking web attacks to OWASP LLM risks, a cross-layer mitigation analysis, and recommendations for adapting security frameworks to LLM-driven ecosystems.The proposed perspective spans client-side, server-side, and LLM-pipeline components and identifies defense gaps.

2 Comparison with Prior Recent Surveys

Prior surveys commonly isolate LLM, agent, privacy, or traditional web risks, whereas this work compares them through a unified full-stack web-security perspective. It maps legacy threats and LLM-native risks across application layers and security frameworks.

  • Prior Survey Scope: Prior LLM surveys often treat the model as the final attack destination rather than a conduit that amplifies legacy client-side web threats.This leaves interactions between LLM vulnerabilities and web-application harms insufficiently examined.
  • Traditional Web Security: Traditional web-security surveys provide mature taxonomies but assume deterministic processing and clear trust boundaries, limiting coverage of LLM-mediated behavior.They do not capture natural-language manipulation, tool and API mediation, or backend-to-client propagation.
  • Full-Stack Perspective: This work bridges prior gaps by mapping the web threat landscape to the OWASP LLM Top 10 across client-side, server-side, pipeline, and ecosystem layers.Its comparison explicitly covers traditional-threat references, framework adaptation, and a unified full-stack perspective.
  • Framework Gap: The survey also argues that established OWASP, ISO/IEC, and NIST AI RMF frameworks require adaptation for interconnected LLM-enabled web ecosystems.The proposed extension targets risks that span isolated components and deployment layers.

3 Our Methodology

The methodology combines OWASP LLM risks with CWE-grounded traditional web vulnerability classes, then uses this mapping to analyze how LLM integration amplifies web threats across application layers.

  • 3 Our Methodology: The analysis begins with OWASP LLM risks and CWE hierarchy-based searches, evaluating weakness descriptions, consequences, and operational context.
  • 3 Our Methodology: The review examines each mapped risk's LLM relevance, web-security analogue, affected system layer, and mitigation strategy.
  • 3 Our Methodology: NIST and ISO security frameworks provide Identify, Protect, Detect, Respond, and Recover principles, but LLM-enabled web systems require stronger LLM-specific mitigation.
  • 3.2 Traditional Threat-Reference Architecture (TRA) and CWE Foundations: The study maps OWASP LLM risks to traditional threat classes and corresponding CWE weaknesses to connect emerging and established security risks.The mapping is based on structural similarity across processing mechanism, security-boundary violation, and impact.
  • 3.3 LLM Integration Patterns: The framework treats LLM integration as a web application stack because untrusted inputs can mediate sensitive client-server operations and amplify legacy vulnerabilities.
  • 3.3 LLM Integration Patterns: The study considers browser agents, APIs, and enterprise applications as integration patterns that broaden the security attack surface.

4 Study Identification and Selection

The study identifies literature through database searching, targeted attack-related queries, screening criteria, and backward and forward snowballing, producing a final corpus of 105 studies.

  • 4.2 Search Keywords: Searches covered Scopus, IEEE Xplore, ScienceDirect, SpringerLink, Google Scholar, and selected high-quality arXiv preprints.
  • 4.2 Search Keywords: Queries combined specific LLM attacks, attack types with LLM, and traditional attack names extended to LLM contexts.
  • 4 Study Identification and Selection: The review excluded papers lacking sufficient technical security content and studies focused solely on general LLM capabilities or applications.
  • 4 Study Identification and Selection: The inclusion criteria covered security and privacy risks, attacks, defenses, AI-security frameworks, and both LLM-enabled and traditional web systems.
  • 4 Study Identification and Selection: The selection process retained 105 studies after database searching, duplicate removal, eligibility screening, and forward and backward snowballing.The initial search yielded 1,050 articles, and 750 unique papers remained after duplicate removal before screening.

5 OWASP LLM and Web Security Risks (RQ1)

The analysis frames prompt injection, information disclosure, and related LLM risks as counterparts or extensions of traditional web vulnerabilities, with natural-language interpretation expanding attack behavior and security boundaries.

  • 5.1 LLM_01: Prompt Injection: Indirect prompt injection broadens the attack surface because external content can influence an LLM that automatically fetches and processes data.
  • 5.1 LLM_01: Prompt Injection: Prompt injection is mapped to classical instruction-injection vulnerabilities and operates as a modern manifestation of injection in LLM-mediated web applications.
  • 5.1 LLM_01: Prompt Injection: LLM browser agents can amplify XSS-like payloads by interpreting webpage content and DOM context, shifting exploitation toward instruction-level manipulation.
  • 5.2.3 Current Mitigation Approaches: Proposed defenses include structured prompting, input separation, context highlighting, spotlighting, and cryptographically signed system prompts.
  • 5.2 TRA_02: Information Disclosure and Data Exfiltration (CWE-200): System-level information exposure extends beyond training-data memorization to confidential data shared across integrated tools during inference.

5.3 LLM_03: Supply Chain Vulnerabilities

LLM supply-chain vulnerabilities arise from untrusted models, datasets, libraries, APIs, retrieval components, and agent skills that can compromise system behavior across the pipeline.

  • 5.3 LLM_03: Supply Chain Vulnerabilities: Compromised external components can introduce harmful behavior into model outputs, while malicious agent-skill documentation can induce payload execution.
  • 5.3 LLM_03: Supply Chain Vulnerabilities: Compromised dependencies can distribute malicious payloads at scale, enabling widespread systemic compromise and harmful outputs across large user populations.
  • 5.3 LLM_03: Supply Chain Vulnerabilities: LLM systems expand the web software supply chain by incorporating external models, datasets, libraries, APIs, retrieval components, and agent skills.
  • 5.3 LLM_03: Supply Chain Vulnerabilities: Supply-chain attacks can modify model behavior through poisoned datasets, backdoor weights, or malicious retrieval documents activated by specific prompts.
  • 5.3 LLM_03: Supply Chain Vulnerabilities: Mitigation requires provenance verification, cryptographic signing, checksum validation, continuous auditing, adversarial testing, anomaly detection, and sandboxing.
  • 5.3 LLM_03: Supply Chain Vulnerabilities: A major open challenge is verifying the trustworthiness of all external components, particularly large-scale datasets and third-party model checkpoints.

5.4 LLM_04: Data and Model Poisoning

LLM_04 concerns persistent corruption of training, retrieval, embedding, or model data that influences later behavior and can amplify into web compromises. The section compares this risk with persistent web data manipulation and reviews validation, provenance, robustness, and privacy defenses alongside unresolved detection challenges.

  • LLM_04: Data and Model Poisoning: Poisoned training data can produce harmful outputs, data leaks, security breaches, or system failures, while poisoned models can trigger attacker-selected behaviors.RLHF alignment pipelines, including DPO, can be poisoned by manipulating a very small fraction of training data.
  • LLM_04: Data and Model Poisoning: Poisoned RAG content can persist into retrieved responses and, when rendered or followed in a browser, cause session theft or XSS-like compromise.The example describes hidden instructions inserted into a public support page and later returned to an authenticated employee.
  • Structural Similarity: LLM_04 parallels stored XSS and SQL injection because malicious inputs persist in system data and affect subsequent application processes.The shared issue is long-term data-integrity violation rather than a transient attack.
  • Mitigations: Authenticity validation, provenance tracking, cryptographic signatures, anomaly detection, regularization, robust optimization, and differential privacy are proposed mitigations.These measures target data integrity, sensitivity to perturbations, poisoning, and memorization-related leakage.
  • Open Research Challenges: Preventing poisoning remains difficult because large heterogeneous datasets contain sources that are hard to verify and samples that can resemble legitimate data.Poisoning embedded in model weights or training processes can also be difficult to detect or remove with conventional runtime defenses.

5.5 LLM_05: Improper Output Handling

LLM_05 arises when generated outputs are not sanitized before downstream processing, allowing model-mediated content to become executable or trigger unauthorized actions. The section connects this failure to indirect output-to-execution attacks and recommends validation, encoding, structured outputs, isolation, and constrained generation.

  • Practical Example: A banking chatbot that renders dynamic HTML can let a malicious query inject JavaScript, execute it in the browser, and expose the user’s session.This practical example directly illustrates output handling as a client-side compromise path.
  • Structural Similarity: LLM-mediated exploitation shifts the vulnerability from direct input injection to indirect output-to-execution attacks through model-generated payloads.The model acts as an intermediary generator whose outputs are later interpreted by other software components.
  • LLM_05: Improper Output Handling: Unsanitized LLM outputs can propagate into downstream systems as executable scripts, unsafe commands, database queries, or API requests.The resulting risk includes XSS, CSRF, injection-based exploits, and unintended execution.
  • Mitigations: HTML escaping, command sanitization, structured output schemas, output validation, HTML encoding, and parameterized queries reduce unsafe interpretation risks.The section specifically associates HTML encoding with XSS prevention and parameterized queries with SQL-injection mitigation.
  • Open Research Challenges: Safely interpreting generated outputs remains difficult because modern pipelines directly trigger code execution, API calls, or database updates from probabilistic model outputs.The paper identifies improper output handling as an open challenge in LLM-enabled systems.

5.6 LLM_06: Excessive Agency

LLM_06 concerns excessive autonomy when agents access tools, services, or privileged operations without sufficiently constrained authorization. The section maps this risk to privilege escalation and CSRF-style actions and emphasizes least privilege, human oversight, auditing, and secure agent architectures.

  • Practical Example: An assistant reusing an active session and excessive tool access can change an email address or initiate a refund without explicit confirmation, resembling CSRF.The example frames hidden webpage instructions as the trigger for unauthorized backend actions.
  • Structural Similarity: The shared failure with traditional privilege escalation is broken authorization and verification, but LLM systems express it through language-driven manipulation of agent decisions.The section identifies this as bypassing security boundaries through the model’s decision-making process.
  • LLM_06: Excessive Agency: Excessive agency lets manipulated LLM agents perform privileged operations beyond intended scope, including API calls, database queries, and confidential-document retrieval.The model can become a confused deputy when it performs privileged operations without verifying request legitimacy.
  • Mitigations: Role-based and capability-based access controls, narrowly scoped permissions, and least privilege limit what agents can do when prompts are manipulated.Human-in-the-loop filtering, auditing, oversight, and continuous monitoring are also presented as safeguards.
  • Open Research Challenges: Reliable authentication and authorization become harder as language models operate autonomously across complex software ecosystems.The paper identifies secure agent architectures combining access control with safeguards against prompt manipulation as a future research need.

5.8 LLM_08: Embedding Weaknesses

LLM_08 concerns leakage and manipulation arising from semantic vector representations used in modern retrieval pipelines. Embedding inversion, poisoning, side channels, and cross-component exchange expand privacy and integrity risks beyond direct software access.

  • LLM_08: Embedding Weaknesses: Embedding weaknesses can enable unauthorized access, data leakage, behavioral alteration, and manipulation when attackers poison training data or exploit vector similarities.The section links these outcomes to vulnerabilities in the embedding process and downstream security-sensitive applications.
  • LLM_08: Embedding Weaknesses: Embedding inversion and indirect inference can reconstruct sensitive queries, proprietary documents, private training data, or session information from vector representations.A support platform’s embeddings can expose reset-password URLs, session identifiers, user IDs, and internal API parameters even after original text is no longer directly exposed.
  • Indirect Inference: Timing, response characteristics, and output token counts can reveal hidden prompts or task-specific information without direct access to protected content.These channels expose internal representations through observable system behavior during inference.
  • Pipeline Propagation: Vector databases, retrieval engines, embedding APIs, and external APIs broaden the attack surface by exchanging representations across multiple pipeline components.The resulting risks include representation leakage, embedding manipulation, and sensitive-information reconstruction.
  • Mitigations: Adversarial training, embedding regularization, differential privacy, and data sanitization are proposed to improve robustness and reduce reconstruction or inference leakage.These defenses constrain perturbation sensitivity and remove sensitive attributes before embedding generation.
  • Open Research Challenges: Complete prevention is difficult because high-dimensional vectors encode rich semantic relationships and embedding APIs and retrieval architectures expand exposure.The paper calls for safer embeddings, secure vector databases, and reliable manipulation detection.

5.9 LLM_09: Misinformation

LLM-generated misinformation can appear credible, be manipulated through prompts or poisoned data, and amplify classical web social-engineering attacks at larger scale. The section also identifies grounding, attribution, human review, and cost-aware controls as open mitigation directions.

  • LLM-generated misinformation can appear credible and difficult to detect, increasing the likelihood that users trust and propagate harmful inaccuracies.The risk is especially consequential in sensitive domains such as healthcare, finance, and legal advice.
  • Practical Example (LLM_09): A manipulated customer-support assistant can direct users to phishing pages, enabling account takeover and automating social engineering for classical web attacks.
  • Structural Similarity: LLM-driven trust exploitation differs from traditional web attacks by automating misleading content generation at much larger scale.
  • Prompt injection, adversarial prompting, and data poisoning can cause LLMs to produce misleading narratives, fabricated facts, and biased explanations.
  • Fact-checking, source attribution, continuous updates, and human-in-the-loop validation are proposed to improve reliability, transparency, and verification.Attribution mechanisms let users trace generated claims to specific source spans.
  • Open Research Challenges: Complete factual accuracy remains difficult because probabilistic generation must be balanced against verification efficiency and scalability.

5.11 CVE Evidence of Zero-Day-Like LLM-Enabled Web Vulnerabilities

Disclosed CVEs show that LLM-mediated vulnerabilities have become concrete web and software weaknesses rather than merely theoretical risks. Across cases, LLMs amplify traditional threats by turning semantic manipulation and generated outputs into client, server, pipeline, and agent-layer harms.

  • LLM-mediated vulnerabilities are appearing as publicly disclosed weaknesses that expand across client, server, pipeline, and agent layers.
  • Prompt injection and insufficient validation can enable remote code execution, SQL injection, tool-mediated data exfiltration, and stored XSS.
  • LLM integration amplifies traditional web-security risks rather than replacing them by shifting exploitation from syntax and code toward meaning and interaction.
  • LLMs can carry backend and pipeline weaknesses into concrete client-side harms, as demonstrated by disclosed CVEs involving data exfiltration and unsafe generated content.
  • RQ2: Existing defenses and standards are necessary but insufficient, leaving recurring gaps in data–instruction separation, output-to-action isolation, agent governance, and runtime leakage detection.

6 Extending Security Frameworks for LLM-Enabled Web Systems (RQ2)

Existing web and AI security frameworks provide useful governance foundations but incompletely address adversarial natural-language manipulation, agent behavior, and post-deployment drift. The proposed LLM-aware framework extends them with layered controls and continuous monitoring across the interaction pipeline.

  • 6.2 Limitations of Existing Frameworks: Existing frameworks and taxonomies provide limited coverage of adversarial natural-language manipulation, agentic behavior, and post-deployment behavioral drift.
  • 6.3 Proposed LLM-Aware Security Framework Extensions: The proposed framework couples governance objectives with semantic validation, prompt integrity, output isolation, capability-constrained agents, behavioral controls, and continuous monitoring.
  • 6.3 Proposed LLM-Aware Security Framework Extensions: The framework extends NIST monitoring dimensions with LLM-specific controls, mapping monitoring objectives to actionable defenses across system interactions.
  • 6.3 Proposed LLM-Aware Security Framework Extensions: Its pipeline applies semantic input validation, separates system instructions from user content, monitors model behavior, isolates outputs from actions, and restricts agent access by least privilege.
  • 6.3 Proposed LLM-Aware Security Framework Extensions: Continuous system-level monitoring tracks interaction patterns over time to detect drift and misuse, while governance controls translate high-level risk principles into enforceable defenses.
  • 6.4 Threats to Validity: The analysis is constrained by reliance on literature and disclosed CVEs available at the search time, so new attack classes may fall outside the identified patterns.

7 Conclusion

The survey shows that LLM-mediated systems re-enable and amplify web risks across multiple layers while weakening core security boundaries. It proposes an LLM-aware monitoring–control framework linking governance objectives with application- and system-level defenses.

  • The taxonomy maps re-enabled and amplified web risks, including XSS and CSRF, to the OWASP LLM Top 10.
  • LLM-related threats emerge across client-side, server-side, and pipeline layers, fundamentally transforming the web threat landscape.
  • LLM-mediated interactions weaken data–instruction, trust, and execution boundaries, creating a dynamic attack surface.
  • The proposed LLM-aware monitoring–control framework connects governance objectives with concrete application- and system-level defenses.
  • The survey highlights the need for robust defenses against both legacy and emerging security threats.
Loading 2609.03999v1…