SPIDES: Information-Flow Control for Browser Agents

Egor Zverev; Juhee Kim; Leon Trampert; Boris Köpf; Aashish Kolluri; Shruti Tople; Santiago Zanella-Béguelin

cs.CROct 16, 2026

SPIDES: Information-Flow Control for Browser Agents

Authors: Egor Zverev, Juhee Kim, Leon Trampert, Boris Köpf, Aashish Kolluri, Shruti Tople, Santiago Zanella-Béguelin

Organizations: ISTA · Microsoft · CISPA Helmholtz Center for Information Security

Abstract

Browser agents automate complex workflows by reading and acting on arbitrary page content, but this flexibility exposes them to prompt injection attacks and unintended data exfiltration. Recent work argues that LLM-driven browser agents erode traditional web security boundaries such as the Same-Origin Policy (SOP) by acting across origins with the user's authority and no built-in isolation. We argue that restoring SOP is neither sufficient (a same-origin public sink can leak private data) nor necessary (legitimate tasks require authorized cross-origin flows) for protecting the security of users. We propose SPIDES, which instead enforces information-flow control by gating primitive browser actions such as typing, clicking and navigating on labels propagated from element-level HTML confidentiality and integrity annotations. Untrusted and confidential content is masked from the agent's context, while policies block unauthorized flows, providing security guarantees against both prompt injection and data exfiltration that hold independently of the model driving the agent. To evaluate SPIDES and baseline defenses under a common threat model, we build MicroNet, a closed ecosystem of 28 interlinked websites with element-level ground-truth labels and paired benign/adversarial tasks. SPIDES achieves 0% attack success rate by design while retaining high task completion rate and autonomy. Our findings demonstrate that information-flow control is an effective technique to extend web security to browser agents, gaining on autonomy and utility against state-of-the-art baselines. The source code and data are openly accessible at https://github.com/microsoft/SPIDES.

Figures & tables

Panel of Figure 1 — Figure 1: Example of SPIDES labelling and masking on a web shop page. (a) The data-ifc-integrity attribute on <section> sets its integrity to Trusted . The <h2> and first <p> inherit this label. On the user-generated <span> , the same attribute overrides the inherited label with Untrusted . The data-ifc-readers attribute on the last <p> sets its reader set to {user, shop.com} . (b) Both the untrusted review and confidential card information are visible to the vanilla agent. (c) SPIDES hides both values as variables before a reveal. (d) After the agent calls inspect_variable on var_3 , the card information becomes visible and the context’s reader set narrows accordingly. The untrusted review remains hidden as var_2 . In (c) and (d), colors and underlines illustrate IFC labels.

Category	Playwright tools	Consequential	Egress	SPIDES policy
Observation	Snapshot: browser_snapshot , browser_wait_for Tab management: browser_tabs (action $\neq$ new) Diagnostics: browser_network_requests , browser_network_request , browser_console_messages	$\times$	$\times$	Always allow.
Action	Navigation and interaction targeting trusted origins: browser_navigate , browser_navigate_back , browser_tabs (action=new) , browser_click , browser_handle_dialog , browser_press_key , browser_type (submit=true)	$\checkmark$	$\checkmark$	$P_{T}$ . Require a trusted agent context and enforce all arguments hold trusted data.
	Navigation and interaction targeting untrusted origins: browser_navigate , browser_navigate_back , browser_tabs (action=new) , browser_click , browser_handle_dialog , browser_press_key , browser_type (submit=true) Egress-only interaction on any origin: browser_fill_form , browser_select_option , browser_type (submit=false)	$\times$	$\checkmark$	$P_{T}\lor P_{F}$ . Require a trusted agent context and trusted arguments, or that all arguments can flow into the target origin.
Execution	Code execution: browser_evaluate , browser_run_code_unsafe	$\checkmark$	$\checkmark$	Always block.

Table 1: Information flow policy for Playwright tools.

Figure 2: Utility and security across models and methods. The top row reports task completion rate (TCR), and the bottom row reports ASR under the Byzantine adversary. Bars and error bars report the mean and one standard deviation across five repetitions, respectively.

Figure 3: Task completion rate as the maximum number of human approvals (

k

) increases. Lines report the mean across 5 repetitions, and shaded regions report one standard deviation.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 4 — Figure 4: Naive HTML-to-snapshot label conversion mislabels data.

Table 2: Distribution of the default 56-task utility suite and 56-scenario attack suite. Same and Cross denote same-origin and cross-origin.

Model	Data dependency	Vanilla	SPIDES	SOPGuard	UCM	UCM+
GPT-5.6 Sol	Independent	$88.3\pm 3.2$	$81.5\pm 2.8$	$90.7\pm 5.6$	$57.1\pm 3.3$	$71.7\pm 5.9$
	Dependent	$98.7\pm 3.0$	$98.7\pm 3.0$	$100.0\pm 0.0$	$96.0\pm 6.0$	$76.0\pm 6.0$
GPT-5.6 Terra	Independent	$83.9\pm 2.8$	$69.8\pm 4.4$	$80.5\pm 5.7$	$33.7\pm 5.3$	$68.8\pm 3.2$
	Dependent	$100.0\pm 0.0$	$97.3\pm 3.7$	$100.0\pm 0.0$	$68.0\pm 3.0$	$72.0\pm 5.6$
Claude Opus 5.5	Independent	$52.7\pm 1.3$	$58.0\pm 4.7$	$53.2\pm 2.0$	$36.1\pm 4.0$	$54.6\pm 1.3$
	Dependent	$73.3\pm 8.2$	$92.0\pm 3.0$	$72.0\pm 9.9$	$84.0\pm 3.7$	$69.3\pm 7.6$

Appendix

Table 3: TCR by whether the user task is data-independent or data-dependent. Each cell reports mean TCR (%) and one standard deviation across five repetitions. The utility suite contains 41 data-independent and 15 data-dependent tasks.

Model	Attack mechanism	Vanilla	SPIDES	SOPGuard	UCM	UCM+
GPT-5.6 Sol	Instruction	$97.6\pm 0.9$	$0.0\pm 0.0$	$59.2\pm 1.1$	$0.0\pm 0.0$	$0.0\pm 0.0$
	Data	$80.0\pm 7.5$	$0.0\pm 0.0$	$46.7\pm 7.5$	$60.0\pm 9.1$	$0.0\pm 0.0$
GPT-5.6 Terra	Instruction	$97.2\pm 1.1$	$0.0\pm 0.0$	$59.2\pm 1.1$	$0.0\pm 0.0$	$0.0\pm 0.0$
	Data	$76.7\pm 9.1$	$0.0\pm 0.0$	$50.0\pm 11.8$	$63.3\pm 7.5$	$0.0\pm 0.0$
Claude Opus 5.5	Instruction	$58.0\pm 2.0$	$0.0\pm 0.0$	$54.8\pm 1.8$	$0.0\pm 0.0$	$0.0\pm 0.0$
	Data	$53.3\pm 7.5$	$0.0\pm 0.0$	$40.0\pm 9.1$	$50.0\pm 16.7$	$0.0\pm 0.0$

Appendix

Table 4: ASR under the Byzantine adversary by attack mechanism. Each cell reports mean ASR (%) and one standard deviation across five repetitions. The benchmark contains 50 instruction-injection and six data-injection scenarios.

Figure 5: Mean token usage per valid utility-task run across models and defenses. Input, output, and total counts combine the main model and QLLM tokens.

Figure 6: Estimated mean token cost in USD per valid utility-task run. Estimates use GitHub Copilot’s default-tier token prices as of September 25, 2026.

Figure 7: Mean security-mechanism tool calls per valid utility-task run across models and defenses. QLLM counts calls to the quarantined model; inspect_variable counts explicit reveals into the main model’s context.

	Required data		Data dependency		Data-flow boundary		Attack goal		Attack mechanism		OpenSource
Benchmark	Untrusted	Confidential	Dependent	Independent	Same	Cross	Confidentiality	Integrity	Instruction	Data	OpenSource
MicroNet	O	O	O	O	O	O	O	O	O	O	O
WASP ( Evtimov et al., 2025 )	O	O	X	O	O	O	O	O	O	X	O
SOPBench ( Wang et al., 2026 )	O	O	X	O	X	O	O	X	O	X	X
WARP ( Li et al., 2026 )	O	X	O	X	O	X	X	O	O	X	O
DoomArena ( Boisvert et al., 2025 )	O	X	O	O	X	O	X	O	O	X	O

Appendix

Table 5: Coverage of browser-use agent security benchmarks. O indicates that the benchmark reports at least one evaluated case with the dimension, while X indicates that it does not.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

Prismata: Confining Cross-Site Prompt Injection in Web Agents
Jul 9, 2026Corban Villa, Alp Eren Ozdarendeli, Sijun Tan +1LLM Agent Security Information Flow Control
UC Berkeley
Same-Origin Policy for Agentic Browsers
Jun 12, 2026Xilong Wang, Xiaoxing Chen, Patrick Li +2Data Leakage AI Agent Security
Duke University · Stanford University · UC Berkeley
WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents
Aug 25, 2026Lin-Fa Lee, YI-YU Chang, Kuo-Hui YehLLM Agent Security Tool Access Control for LLM Agents
Department of Institute of Artificial Intelligence Innovation National Yang Ming Chiao Tung University Hsinchu, Taiwan

Jul 9, 2026J/K move · Enter open · S save

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Corban Villa, Alp Eren Ozdarendeli, Sijun Tan, Raluca Ada Popa

UC Berkeley

LLM Agent Security Information Flow Control Prompt Injection Defense Prompt Injection Attacks Web Agents

Open paper AskPDF arXiv

Autonomous web agents promise to automate everyday browsing tasks, but inherit one of the web's oldest attack surfaces. Cross-Site Scripting proved that mixing trusted and untrusted content is dangerous, even on benign pages. Agents resurface this risk by interpreting natural language as instructions, allowing third-party and user-generated content to hijack the agent via prompt injection. The core challenge is that deriving a task-specific security policy requires reasoning over page structure that is entangled with the attacker's content. We present Prismata, a defense enforcing contextual least privilege for web agents, constraining both what the agent sees and what it can do. Prismata's dynamic trust derivation produces permission labels for page content, with structural confinement guarantees, inspired by classical integrity models, that bound any labeling errors so that labels can only decrease in privilege and mislabelings are bounded. Prismata's mechanical confinement enforces these labels by redacting content and restricting agent capabilities. Importantly, these mechanisms require no developer annotations, so Prismata supports the long tail of websites. Across recent published web agent attacks, including adaptive variants, Prismata substantially reduces attack success while preserving benign task utility.

Abstract

LLM Agent Security

Explore similar work

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Same-Origin Policy for Agentic Browsers

WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents