# A Whole New World: Creating a Parallel-Poisoned Web Only AI-Agents Can See

arXiv: https://arxiv.org/abs/2509.00124 · HTML: https://mlsanity.com/paper/2509.00124/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 4 of its 14 references that are in the map.
- First posted on arXiv 29 Aug 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 4 of 4)

- [AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases](https://mlsanity.com/paper/2407.12784/) (2024)
- [Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree](https://mlsanity.com/paper/2507.14799/) (2025)
- [The Hidden Dangers of Browsing AI Agents](https://mlsanity.com/paper/2505.13076/) (2025)
- [PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites](https://mlsanity.com/paper/2508.02035/) (2025)

## Built on by (most cited first, 3 of 3)

- [LegalWebAgent: Empowering Access to Justice via LLM-Based Web Agents](https://mlsanity.com/paper/2512.04105/) (2025)
- [Identifying AI Web Scrapers Using Canary Tokens](https://mlsanity.com/paper/2605.13706/) (2026)
- [On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models](https://mlsanity.com/paper/2608.10530/) (2026)

## Abstract (arXiv)

This paper introduces a novel attack vector that leverages website cloaking techniques to compromise autonomous web-browsing agents powered by Large Language Models (LLMs). As these agents become more prevalent, their unique and often homogenous digital fingerprints - comprising browser attributes, automation framework signatures, and network characteristics - create a new, distinguishable class of web traffic. The attack exploits this fingerprintability. A malicious website can identify an incoming request as originating from an AI agent and dynamically serve a different, "cloaked" version of its content. While human users see a benign webpage, the agent is presented with a visually identical page embedded with hidden, malicious instructions, such as indirect prompt injections. This mechanism allows adversaries to hijack agent behavior, leading to data exfiltration, malware execution, or misinformation propagation, all while remaining completely invisible to human users and conventional security crawlers. This work formalizes the threat model, details the mechanics of agent fingerprinting and cloaking, and discusses the profound security implications for the future of agentic AI, highlighting the urgent need for robust defenses against this stealthy and scalable attack.