ANGLER: Verifier-Grounded Benchmarking with an Adaptive Attacker for Web Agents

Summary

Researchers introduce REEF, a benchmark of 9 verifier-grounded websites that pairs benign web-agent tasks with malicious objectives delivered through 5 attack types, and ANGLER, an adaptive attack framework that uses execution feedback to mutate attacks. Across 8 VLM-based web agents, ANGLER reaches a 20.36% end-to-end attack success rate versus 15.24% for a non-adaptive setting. It also cuts benign task success from 61.9% to 44.4% compared with attack-free execution.

Related items

• MediumTop AI coding agent security resources — November 2026Similar attack · Adversa AI Blog
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSimilar attack · NVD/CVE Database
• HighCVE-2026-61789: DBHub read-only SQL validation bypass on MySQL and MariaDB connectorsSimilar attack · NVD/CVE Database
• InfoSecPO: Principled Adversarial Training for Prompt Injection SecuritySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)