mlsanityData to 14 Oct 2026

WebInject: Prompt Injection Attack to Web Agents

arXiv 2505.11717 ↗First posted 16 May 2025cs.LG cs.AI cs.CLcited by 51

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Multi-modal large language model (MLLM)-based web agents interact with webpage environments by generating actions based on screenshots of the webpages. In this work, we propose WebInject, a prompt injection attack that manipulates the webpage environment to induce a web agent to perform an attacker-specified action. Our attack adds a perturbation to the raw pixel values of the rendered webpage. After these perturbed pixels are mapped into a screenshot, the perturbation induces the web agent to perform the attacker-specified action. We formulate the task of finding the perturbation as an optimization problem. A key challenge in solving this problem is that the mapping between raw pixel values and screenshot is non-differentiable, making it difficult to backpropagate gradients to the perturbation. To overcome this, we train a neural network to approximate the mapping and apply projected gradient descent to solve the reformulated optimization problem. Extensive evaluation on multiple datasets shows that WebInject is highly effective and significantly outperforms baselines.

Key facts. Cited by 51 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 20 of its 31 references that are in the map. First posted on arXiv 16 May 2025.

Builds on

20 of 31 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  2. 2024Attacking Vision-Language Computer Agents via Pop-ups4 Nov
  3. 2024AdvAgent: Controllable Blackbox Red-teaming on Web Agents22 Oct
  4. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep
  5. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun
  6. 2024Dissecting Adversarial Robustness of Multimodal LM Agents18 Jun

Other references · 14

  1. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2025Qwen2.5-VL Technical Reportcited by 5,587
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2025Gemma 3 Technical Reportcited by 1,824
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  7. 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 563
  8. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  9. 2025Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAscited by 521
  10. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 143
  11. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attackscited by 143
  12. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 127
2 more
  1. 2024Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignmentcited by 21
  2. 2025On the Robustness of GUI Grounding Models Against Image Attackscited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 8; 2026: 43.

51 papers.

Sort:

By area:

  1. 2025PromptArmor: Simple yet Effective Prompt Injection Defensescited by 108
  2. 2025VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agentscited by 45
  3. 2025PromptLocate: Localizing Prompt Injection Attackscited by 28
  4. 2026SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agentscited by 25
  5. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agentscited by 24
  6. 2026ClawSafety: "Safe" LLMs, Unsafe Agentscited by 17
  7. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  8. 2026WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agentscited by 11
  9. 2025DualTAP: A Dual-Task Adversarial Protector for Mobile MLLM Agentscited by 9
  10. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  11. 2025From ASR to ASP: Evaluating Prompt Attack Vulnerabilities Against Open-Source LLMscited by 6
  12. 2026What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?cited by 6
38 more
  1. 2025Permission Manifests for Web Agentscited by 5
  2. 2026Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screeningcited by 5
  3. 2026How do Visual Attributes Influence Web Agents? A Comprehensive Evaluation of User Interface Design Factorscited by 4
  4. 2026Web Agents Should Adopt the Plan-Then-Execute Paradigmcited by 4
  5. 2026WARD: Adversarially Robust Defense of Web Agents Against Prompt Injectionscited by 4
  6. 2025Adversarial Confusion Attack: Disrupting Multimodal Large Language Modelscited by 3
  7. 2026ClawTrap: A MITM-Based Red-Teaming Framework for Real-World OpenClaw Security Evaluationcited by 3
  8. 2026Clawed and Dangerous: Can We Trust Open Agentic Systems?cited by 3
  9. 2026Preference Redirection via Attention Concentration: An Attack on Computer Use Agentscited by 3
  10. 2026WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agentscited by 3
  11. 2026Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agentscited by 3
  12. 2026Untrusted Content Masking for Web Agents with Security Guaranteescited by 3
  13. 2026Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluationcited by 3
  14. 2026Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agentscited by 2
  15. 2026HijackKV: New Threat in Position-Independent KV Cache Reusecited by 2
  16. 2026Steerability of Instrumental-Convergence Tendencies in LLMscited by 1
  17. 2026Extended to Reality: Prompt Injection in 3D Environmentscited by 1
  18. 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directionscited by 1
  19. 2026SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systemscited by 1
  20. 2026AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injectioncited by 1
  21. 2026An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworkscited by 1
  22. 2026CleanBase: Detecting Malicious Documents in RAG Knowledge Databasescited by 0
  23. 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliabilitycited by 0
  24. 2026WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agentscited by 0
  25. 2026MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agentscited by 0
  26. 2026Do GUI Agents Believe Their Eyes? Diagnosing State-Belief Reliance on Pixels versus Structurecited by 0
  27. 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agentscited by 0
  28. 2026MissClick: Execution-Aware Adversarial Attacks on Coordinate Generation in GUI Grounding Modelscited by 0
  29. 2026WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agentscited by 0
  30. 2026Lazy Grounding: Attacking Search Agents with Factual Evidencecited by 0
  31. 2026Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrailscited by 0
  32. 2026AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agentscited by 0
  33. 2026Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputscited by 0
  34. 2026ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agentscited by 0
  35. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  36. 2026Policy-Backed Selective Regeneration under Tainted Inter-Agent Communicationcited by 0
  37. 2026CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agentscited by 0
  38. 2026Adversarial Images Hijack Web Agents from Visual Grounding to Browser Executioncited by 0

50 most cited of 51 All 51 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery
  2. 2026SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents
  3. 2025WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
  4. 2026AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
  5. 2026MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks
  6. 2025Mind the Web: The Security of Web Use Agents
  7. 2025Context manipulation attacks : Web agents are susceptible to corrupted memory
  8. 2025It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents