mlsanityData to 7 Oct 2026

ceLLMate: Sandboxing Browser AI Agents

arXiv 2512.12594 ↗First posted 14 Dec 2025cs.CR cs.LGcited by 14

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Browser-using agents (BUAs) are an emerging class of AI agents that interact with web browsers in human-like ways, including clicking, scrolling, filling forms, and navigating across pages. While these agents help automate repetitive online tasks, they are vulnerable to prompt injection attacks that trick an agent into performing undesired actions, such as leaking private information or issuing unintended state-changing requests. We propose ceLLMate, a browser-level sandboxing framework that restricts the agent's ambient authority and reduces the blast radius of prompt injections. We address the semantic gap challenge that is fundamental to BUAs -- writing and enforcing security policies for low-level UI tools like clicks and keystrokes is brittle and error-prone. Our core insight is to perform sandboxing at the HTTP layer because all side-effecting UI operations will result in network communication to the website's backend. We implement ceLLMate as an agent-agnostic browser extension and demonstrate how it enables sandboxing policies that block prompt injection attacks in the WASP benchmark with 7.25--15% latency overhead.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 30 of its 69 references that are in the map. First posted on arXiv 14 Dec 2025.

Builds on

30 of 69 references.

Closest ancestors · 13

Same direction, newest first

  1. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents25 Nov
  2. 2025WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents1 Oct
  3. 2025PromptArmor: Simple yet Effective Prompt Injection Defenses21 Jul
  4. 2025WebGuard: Building a Generalizable Guardrail for Web Agents18 Jul
  5. 2025May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks10 Jul
  6. 2025Lessons from Defending Gemini Against Indirect Prompt Injections20 May
  7. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  8. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks15 Apr
  9. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMs1 Nov
  10. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions19 Apr
  11. 2024Defending Against Indirect Prompt Injection Attacks With Spotlighting20 Mar
  12. 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks6 Mar
1 more
  1. 2024StruQ: Defending Against Prompt Injection with Structured Queries9 Feb

Other references · 17

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  4. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
  5. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,302
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  8. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  9. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMscited by 146
  10. 2025Securing AI Agents with Information-Flow Controlcited by 108
  11. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  12. 2024Imprompter: Tricking LLM Agents into Improper Tool Usecited by 66
5 more
  1. 2025Contextual Agent Security: A Policy for Every Purposecited by 55
  2. 2025Towards Automating Data Access Permissions in AI Agentscited by 20
  3. 2025Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interfacecited by 15
  4. 2025A Systematization of Security Vulnerabilities in Computer Use Agentscited by 11
  5. 2019The Android Platform Security Model (2023)cited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 14.

14 papers.

Sort:

By area:

  1. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 15
  2. 2026Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agentscited by 12
  3. 2026Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agentscited by 5
  4. 2026An AI Agent Execution Environment to Safeguard User Datacited by 3
  5. 2026Web Agents Should Adopt the Plan-Then-Execute Paradigmcited by 3
  6. 2026Untrusted Content Masking for Web Agents with Security Guaranteescited by 3
  7. 2026Agent Security is a Systems Problemcited by 2
  8. 2026Prismata: Confining Cross-Site Prompt Injection in Web Agentscited by 1
  9. 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliabilitycited by 0
  10. 2026Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environmentscited by 0
  11. 2026The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilitiescited by 0
  12. 2026Rethinking Agent Security as a Networking Problemcited by 0
2 more
  1. 2026Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarkscited by 0
  2. 2026Secure-CUA: Controlling Untrusted Influence in Computer-Use Agentscited by 0