mlsanityData to 7 Oct 2026

WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks

arXiv 2504.18575 ↗First posted 22 Apr 2025cs.CR cs.AIcited by 140

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Autonomous UI agents powered by AI have tremendous potential to boost human productivity by automating routine tasks such as filing taxes and paying bills. However, a major challenge in unlocking their full potential is security, which is exacerbated by the agent's ability to take action on their user's behalf. Existing tests for prompt injections in web agents either over-simplify the threat by testing unrealistic scenarios or giving the attacker too much power, or look at single-step isolated tasks. To more accurately measure progress for secure web agents, we introduce WASP -- a new publicly available benchmark for end-to-end evaluation of Web Agent Security against Prompt injection attacks. Evaluating with WASP shows that even top-tier AI models, including those with advanced reasoning capabilities, can be deceived by simple, low-effort human-written injections in very realistic scenarios. Our end-to-end evaluation reveals a previously unobserved insight: while attacks partially succeed in up to 86% of the case, even state-of-the-art agents often struggle to fully complete the attacker goals -- highlighting the current state of security by incompetence.

Key facts. Cited by 140 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 34 of its 45 references that are in the map. First posted on arXiv 22 Apr 2025.

Builds on

34 of 45 references.

Closest ancestors · 12

Same direction, newest first

  1. 2025The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injections15 Apr
  2. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks12 Feb
  3. 2024Attacking Vision-Language Computer Agents via Pop-ups4 Nov
  4. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  5. 2024Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents11 Oct
  6. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
  7. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  8. 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Tester2 Oct
  9. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep
  10. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun
  11. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  12. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 22

  1. 2024GPT-4o System Cardcited by 4,467
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,302
  6. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  7. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  8. 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 547
  9. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  10. 2024WebVoyager: Building an End-to-End Web Agent with Large Multimodal Modelscited by 424
  11. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  12. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
10 more
  1. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  2. 2023Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4Vcited by 291
  3. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
  4. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMscited by 146
  5. 2023Jatmo: Prompt Injection Defense by Task-Specific Finetuningcited by 89
  6. 2024CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Modelscited by 84
  7. 2024A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systemscited by 74
  8. 2024Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchycited by 62
  9. 2024Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractionscited by 55
  10. 2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 27; 2026: 113.

140 papers.

Sort:

By area:

  1. 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agentscited by 104
  2. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attackscited by 82
  3. 2026ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedbackcited by 64
  4. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  5. 2025RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environmentscited by 42
  6. 2025RiOSWorld: Benchmarking the Risk of Multimodal Computer-Use Agentscited by 34
  7. 2025RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injectioncited by 32
  8. 2026AgentLAB: Benchmarking LLM Agents against Long-Horizon Attackscited by 31
  9. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
  10. 2026"Humans welcome to observe": A First Look at the Agent Social Network Moltbookcited by 25
  11. 2025A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?cited by 23
  12. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agentscited by 23
38 more
  1. 2025Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competitioncited by 22
  2. 2025WAInjectBench: Benchmarking Prompt Injection Detections for Web Agentscited by 21
  3. 2026A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypescited by 19
  4. 2026MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attackscited by 18
  5. 2026Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agentscited by 18
  6. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystemcited by 17
  7. 2025SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agentscited by 17
  8. 2025FocusAgent: Simple Yet Effective Ways of Trimming the Large Context of Web Agentscited by 16
  9. 2026How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competitioncited by 16
  10. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  11. 2025Dark Patterns Meet GUI Agents: LLM Agent Susceptibility to Manipulative Interfaces and the Role of Human Oversightcited by 15
  12. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 15
  13. 2026ClawSafety: "Safe" LLMs, Unsafe Agentscited by 15
  14. 2026SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfacescited by 15
  15. 2025ConVerse: Benchmarking Contextual Safety in Agent-to-Agent Conversationscited by 14
  16. 2026VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commitcited by 13
  17. 2026The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agentscited by 12
  18. 2026SafePred: A Predictive Guardrail for Computer-Using Agents via World Modelscited by 11
  19. 2025HarmonyGuard: Toward Safety and Utility in Web Agents via Adaptive Policy Enhancement and Dual-Objective Optimizationcited by 10
  20. 2026WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agentscited by 10
  21. 2026Optimizing Agent Planning for Security and Autonomycited by 10
  22. 2026PIArena: A Platform for Prompt Injection Evaluationcited by 10
  23. 2025Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directednesscited by 8
  24. 2026LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarioscited by 8
  25. 2026When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agentscited by 8
  26. 2026The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneckcited by 8
  27. 2025Graph2Eval: Automatic Multimodal Task Generation for Agents via Knowledge Graphscited by 7
  28. 2025Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agentscited by 7
  29. 2025Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attackscited by 6
  30. 2025LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agentscited by 6
  31. 2025Safety Alignment of LMs via Non-cooperative Gamescited by 6
  32. 2026When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agentcited by 6
  33. 2026Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworkscited by 6
  34. 2026A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governancecited by 5
  35. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
  36. 2026How do Visual Attributes Influence Web Agents? A Comprehensive Evaluation of User Interface Design Factorscited by 4
  37. 2026Reinforcement Learning for LLM-based Multi-Agent Systems through Orchestration Tracescited by 4
  38. 2026SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Constructioncited by 4

50 most cited of 140 All 140 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents
  2. 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?
  3. 2025Building Browser Agents: Architecture, Security, and Practical Solutions
  4. 2025Mind the Web: The Security of Web Use Agents
  5. 2025Context manipulation attacks : Web agents are susceptible to corrupted memory
  6. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks
  7. 2025Who Grants the Agent Power? Defending Against Instruction Injection via Task-Centric Access Control
  8. 2025DoomArena: A framework for Testing AI Agents Against Evolving Security Threats