mlsanityData to 7 Oct 2026

Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree

arXiv 2507.14799 ↗First posted 20 Jul 2025cs.CR cs.AIcited by 13

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

This work demonstrates that LLM-based web navigation agents offer powerful automation capabilities but are vulnerable to Indirect Prompt Injection (IPI) attacks. We show that adversaries can embed universal adversarial triggers in webpage HTML to hijack agent behavior that utilizes the accessibility tree to parse HTML, causing unintended or malicious actions. Using the Greedy Coordinate Gradient (GCG) algorithm and a Browser Gym agent powered by Llama-3.1, our system demonstrates high success rates across real websites in both targeted and general attacks, including login credential exfiltration and forced ad clicks. Our empirical results highlight critical security risks and the need for stronger defenses as LLM-driven autonomous web agents become more widely adopted. The system software (https://github.com/sej2020/manipulating-web-agents) is released under the MIT License, with an accompanying publicly available demo website (http://lethaiq.github.io/attack-web-llm-agent).

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 10 of its 17 references that are in the map. First posted on arXiv 20 Jul 2025.

Builds on

10 of 17 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents27 Feb
  2. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct

Other references · 8

  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  6. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  7. 2024WorkArena: How Capable Are Web Agents at Solving Common Knowledge Work Tasks?cited by 348
  8. 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Samplingcited by 33

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 4; 2026: 9.

13 papers.

Sort:

By area:

  1. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
  2. 2025SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agentscited by 17
  3. 2026SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deploymentcited by 14
  4. 2025Environmental Injection Attacks against GUI Agents in Realistic Dynamic Environmentscited by 5
  5. 2025A Whole New World: Creating a Parallel-Poisoned Web Only AI-Agents Can Seecited by 3
  6. 2026Agent Security is a Systems Problemcited by 2
  7. 2026D-Models and E-Models: Diversity-Stability Trade-offs in the Sampling Behavior of Large Language Modelscited by 1
  8. 2026Designing Agent-Ready Websites for AI Web Agents: A Framework for Machine Readability, Actionability, and Decision Reliabilitycited by 0
  9. 2026From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systemscited by 0
  10. 2026LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agentscited by 0
  11. 2026Lazy Grounding: Attacking Search Agents with Factual Evidencecited by 0
  12. 2026AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agentscited by 0
1 more
  1. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025In-Browser LLM-Guided Fuzzing for Real-Time Prompt Injection Testing in Agentic AI Browsers
  2. 2024LLM Agents can Autonomously Hack Websites
  3. 2026WAAA! Web Adversaries Against Agentic Browsers
  4. 2024WIPI: A New Web Threat for LLM-Driven Web Agents
  5. 2025Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysis
  6. 2026From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications
  7. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents
  8. 2025The Hidden Dangers of Browsing AI Agents