Securing Web Agents with the Compile-Then-Execute Paradigm

Summary

Baya is a web agent that compiles a user's request into a Python program calling a Trusted Website API before touching the live site, so the planning model never sees untrusted page content. Untrusted data can set values or pick among branches fixed at compile time, but cannot redefine the task or add new operations. On 581 valid WebArena Verified tasks it reaches 77.8% aggregate utility, versus 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct, and it achieves 0% attack success rate on WASP compared with 16.2% and 25.5% for the ReAct baselines.

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• InfoSecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoWhen File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office DocumentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog