SPIDES gates browser-agent actions with information-flow labels
Original title: SPIDES: Information-Flow Control for Browser Agents
Microsoft's prototype reports 0% attack success on MicroNet, a closed set of 28 labeled websites.
Browser agents that read and act on page content can be prompt-injected and can exfiltrate data across origins. SPIDES gates typing, clicking, and navigating using labels propagated from element-level HTML confidentiality and integrity annotations. Untrusted and confidential content is masked, and policies block unauthorized flows independent of the driving model. Evaluation uses MicroNet, with paired benign and adversarial tasks; code and data are public.
Unconfirmed: Attack-success and utility figures are the authors' evaluation against their baselines.
- Authors say restoring the Same-Origin Policy is neither sufficient nor necessary.
- Guarantees are claimed to hold independently of the model.
- MicroNet has element-level ground-truth labels.
- Source code and data are at github.com/microsoft/SPIDES.
- Vendors
- Microsoft
From the original article
1 min read at arxiv.orgBrowser agents automate complex workflows by reading and acting on arbitrary page content, but this flexibility exposes them to prompt injection attacks and unintended data exfiltration. Recent work argues that LLM-driven browser agents erode traditional web security boundaries such as the Same-Origin Policy (SOP) by acting across origins with the user's authority and no built-in isolation.
By Egor Zverev · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.