The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
Verifiable Action Card architecture blocks indirect prompt injection in agentic browsers, cutting attack success from 68-100% to 0%.
Researchers propose VAC, a browser-architecture defense that reconstructs approval prompts from the ground-truth pending action and trusted intent provenance, rendering them out-of-band in trusted browser chrome. On a 24-scenario benchmark covering confused-deputy attacks, dialog forging, and indirect prompt injection, attack success fell from 68-100% to 0% across evaluated LLMs, with 78% legitimate-task completion and a 0% false-block rate. Approval is bound to the exact action re-verified at dispatch.
- Approvals bound to the exact action re-verified at dispatch
- Combines provenance fencing, default-deny confirmation, risk gating
- Benchmark covers prompt injection and Lies-in-the-Loop dialog forging
- 0% attack success with 78% legitimate task completion
- Products
- Verifiable Action Card
From the original article
1 min read at arxiv.orgAgentic browsers can execute security-sensitive actions under a user's authenticated session, making indirect prompt injection and deceptive confirmation interfaces a direct threat to action integrity. Existing human-in-the-loop (HITL) safeguards are insufficient when the approval prompt itself can be influenced by untrusted page content or model-generated text.
By Hasnain Irshad · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.