Intact isolates agent browsing from injected third-party page text
Original title: What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics
On 1,091 attacked pages, 12.8% of injections reached the planner versus 73.1% for a conventional planner.
Researchers propose Intact, which runs on an unmodified browser and passes each page to the LLM as GenTree, one element at a time, with provenance and web semantics. The harness executes a step only within that element's capabilities and asks the user before acting on third-party content. The goal is to stop injected text from persuading an agent to use the user's authority for content that has none.
Unconfirmed: Blocking and attribution rates are reported by the paper's authors.
- On 1,270 pages, GenTree attributes 2.3 times as many elements to third parties.
- The browser misattributes 58.7% of those third-party elements to the first party.
- Attacks that pass Intact's planner do so at most as a consent request.
- Isolation disrupts functionality on 3.7% of tasks.
- A parallel schedule could remove most of the added latency.
From the original article
1 min read at huggingface.co
AI agents increasingly browse the web on users' behalf, yet they consume webpages as screenshots or text, exposing their LLMs to unvetted third-party content. Browsers enforce semantics under which what an element can do depends on what it is and where it comes from, not on what it says. Agents flatten these semantics, so injected text can persuade the LLM to exercise the user's authority for content that has none.
By Umar Iqbal · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.