Abstract:Generalist web agents have demonstrated remarkable potential in autonomously completing a wide range of tasks on real websites, significantly boosting human productivity. However, web tasks, such as booking flights, usually involve users' PII, which may be exposed to potential privacy risks if web agents accidentally interact with compromised websites, a scenario that remains largely unexplored in the literature. In this work, we narrow this gap by conducting the first study on the privacy risks of generalist web agents in adversarial environments. First, we present a realistic threat model for attacks on the website, where we consider two adversarial targets: stealing users' specific PII or the entire user request. Then, we propose a novel attack method, termed Environmental Injection Attack (EIA). EIA injects malicious content designed to adapt well to environments where the agents operate and our work instantiates EIA specifically for privacy scenarios in web environments. We collect 177 action steps that involve diverse PII categories on realistic websites from the Mind2Web, and conduct experiments using one of the most capable generalist web agent frameworks to date. The results demonstrate that EIA achieves up to 70% ASR in stealing specific PII and 16% ASR for full user request. Additionally, by accessing the stealthiness and experimenting with a defensive system prompt, we indicate that EIA is hard to detect and mitigate. Notably, attacks that are not well adapted for a webpage can be detected via human inspection, leading to our discussion about the trade-off between security and autonomy. However, extra attackers' efforts can make EIA seamlessly adapted, rendering such supervision ineffective. Thus, we further discuss the defenses at the pre- and post-deployment stages of the websites without relying on human supervision and call for more advanced defense strategies.

Environment-driven Threats Elicitation for Web Applications

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Estimating Security Risk for Web Applications Using Security Vectors

A Threat Model Driven Approach for Security Testing

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

D-WAV: A Web Application Vulnerabilities Detection Tool Using Characteristics of Web Forms

Supporting secure programming in web applications through interactive static analysis.

Design and implementation of a web application vulnerability detection system

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

Threat models over space and time: A case study of end‐to‐end‐encrypted messaging applications

Design and Applying of Web Application Security Detecting System

Toward Exposing Timing-Based Probing Attacks in Web Applications

Threat Detection in Trigger-Action Programming Rules of Smart Home With Heterogeneous Information Network Model

Evaluation of Static Analysis on Web Applications

SENet: Visual Detection of Online Social Engineering Attack Campaigns

EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage

Access Control Vulnerabilities Detection for Web Application Components

A set of features to detect web security threats

Detecting Malicious Websites in Depth through Analyzing Topics and Web-pages

Malware Characteristics and Threats on the Internet Ecosystem