AgentBreaker: Evaluating Context-Aware Indirect Prompt Injection Risks in Modern Web Agents

Summary

Researchers present AgentBreaker, an indirect prompt injection framework that autonomously writes adversarial phrases tailored to each page's context and embeds them as HTML elements. Against five state-of-the-art web agents across 60 webpages sampled from Online-Mind2Web, it reached an attack success rate of 71.7%–100%, inducing actions such as clicking attacker-designated elements, posting attacker-provided text and disclosing internal agent secrets.

Mitigation

The authors propose defenses that mitigate the observed threats and address potential adaptive attacks, reducing the attack success rate to 1.7%. The source does not describe the individual defense mechanisms in the provided text.

Topics

• Prompt injection and jailbreaks

Related items

• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading
• MediumGHSA-hmq2-7hp6-7crh: Banks: User-controlled prompt input can be parsed as privileged chat messagesSimilar attack · GitHub Advisory Database
• CriticalGHSA-9mp3-24cc-77mg: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsSimilar attack · GitHub Advisory Database
• Medium'AgentCorruption' Puts AWS Environments At Risk With Single PromptSimilar attack · Dark Reading
• MediumGHSA-4xxv-6wmf-xf45: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspaceSimilar attack · GitHub Advisory Database