Prompt Injection Attacks

Follow this topic Ask about this topic

Momentum

11 papers in the last four weeks, against 1 the four weeks before. 0.1% of all new papers.

Jul 13Week of Sep 28

Latest papers 70

All topics

WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation
May 8, 2026Zhichao Liu, Wenbo Pan, Haining Yu +3Indirect Prompt Injection Prompt Injection Attacks
Harbin Institute of Technology · City University of Hong Kong · City University of Macau
SafeReview: Defending LLM-based Review Systems Against Adversarial Hidden Prompts
Apr 29, 2026Yuan Xin, Yixuan Weng, Minjun Zhu +5Adversarial Training Adversarial Prompt Generation
1CISPA · 2Westlake University · 3Southern University of Science and Technology +1
Evaluation of Prompt Injection Defenses in Large Language Models
Apr 26, 2026Priyal Deep, Shane Emmons, Amy Fox +4Data Leakage Privacy Leakage in Language Models
Swept AI[1] · University of Michigan
When AI reviews science: Can we trust the referee?
Apr 26, 2026Jialiang Wang, Yuchen Liu, Hang Xu +7LLM Auditing Adversarial Attacks on LLMs
Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Hong Kong SAR 999077, China · Key Laboratory of New Generation Artificial Intelligence Technology and Its Interdisciplinary Applications, School of Computer Science and Engeering, Southeast University, Nanjing 210000, China · These authors contributed equally +2
Conjunctive Prompt Attacks in Multi-Agent LLM Systems
Apr 17, 2026Nokimul Hasan Arif, Qian Lou, Mengxin ZhengMulti-Agent LLM Systems Adversarial Attacks on LLMs
University of Central Florida, USA
Prompt Injection as Role Confusion
Feb 22, 2026Charles Ye, Jasmine Cui, Dylan Hadfield-MenellAdversarial Attacks on LLMs Prompt Injection Attacks
*Equal contribution 1Independent · 2Massachusetts Institute of Technology, Cambridge, MA, United States
It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents
Dec 29, 2025Karolina Korgul, Yushi Yang, Arkadiusz Drohomirecki +7Web Agent Benchmarks Indirect Prompt Injection
University of Oxford · 2SoftServe · 3Independent +1
"Give a Positive Review Only": An Early Investigation Into In-Paper Prompt Injection Attacks and Defenses for AI Reviewers
Nov 3, 2025Qin Zhou, Zhexin Zhang, Zhi Li +1Adversarial Prompt Generation Indirect Prompt Injection
Institute of Information Engineering, CAS, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China · The Conversational AI (CoAI) group, DCST, Tsinghua University
WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
Oct 1, 2025Yinuo Liu, Xilong Wang, Ruohan Xu +2Web Agent Benchmarks Prompt Injection Attacks
Duke University
Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment
Sep 6, 2025Yuchong Xie, Mingyu Luo, Zesen Liu +7Prompt Injection AI Coding Agents
The Hong Kong University of Science and Technology, China · Fudan University, China

May 8, 2026, cs.CRJ/K move · Enter open · S save

WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation

Zhichao Liu, Wenbo Pan, Haining Yu, Ge Gao+2

Harbin Institute of Technology · City University of Hong Kong · City University of Macau

Indirect Prompt Injection Prompt Injection Attacks Long-Horizon Agent Tasks Web Agents

Open paper AskPDF arXiv

Browser agents are increasingly deployed in long-horizon tasks, which require executing extended action chains to accomplish user goals. However, this prolonged execution process provides attackers with more opportunities to inject malicious instructions. Existing prompt injection attacks against browser agents expose two key gaps: (1) low effectiveness, as attacks optimized for toy baselines fail to achieve end-to-end goals in real-world scenarios with complex environments and longer steps; (2) weak stealthiness, since most attacks pit the attack goal against the user goal, causing a significant drop in system usability under attack. To address these gaps, we propose WebTrap, a mid-task hijacking injection attack. It employs multi-step instruction fusion steering to seamlessly combine both goals, enabling the agent to resume the original user task after executing the attack goal. Furthermore, we design a context-grounded generation method to align the injected content with the task environment and system instructions, maximizing the hijacking success rate. Extensive experiments on two browser agent tasks, based on extended WASP and InjecAgent environments, demonstrate that our method achieves a high attack success rate while preserving the usability of the original system. We find that WebTrap exploits the agent's navigation vulnerabilities, binding the two goals so tightly that standard defense mechanisms cannot restore the system to normal operation. These findings reveal a critical vulnerability in agent systems during long-horizon tasks that they can be stealthily hijacked.

Momentum

Related topics

Latest papers 70