Skip to content

It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents

🕒 Published (v1): 2025-12-29 01:09 UTC · Source: Arxiv · Venue: ICML 2026 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

TRAP is a 630-task benchmark evaluating prompt injection susceptibility in web-based LLM agents across six realistic website clones, using a five-dimensional modular attack space grounded in social-engineering and jailbreak techniques. Across six frontier models, agents are hijacked in 25% of tasks on average (13% for GPT-5, 43% for DeepSeek-R1). Small interface and contextual changes — buttons vs. hyperlinks, light task-specific tailoring — can multiply attack success rates by 3–6×.

Problem

Existing prompt injection benchmarks for web agents are static, monolithic, and rely on multi-step LLM-judged outcomes that conflate refusal with failure. They also use simplified sandboxes rather than realistic website replicas, making it hard to isolate which attack components cause agent failures or to compare across models in a controlled way.

Method

TRAP builds on REAL, a framework hosting deterministic clones of six popular websites (Google Calendar, Gmail, Amazon, LinkedIn, DoorDash, Upwork). Each injection is composed from five independently varied components: (1) interaction vector (button or hyperlink), (2) human persuasion principle (Cialdini's seven principles: authority, reciprocity, scarcity, liking, social proof, consistency, unity), (3) LLM manipulation method (adversarial suffixes, chain-of-thought injection, many-shot/many-turn conditioning, role-play/storytelling, override/ignore instructions), (4) injection location (user-editable page regions), and (5) contextual tailoring (task-specific lexical substitution, ≤20% of text). The benchmark pairs 18 benign tasks with 35 injection templates for 630 combinations. Attack success is defined as a single binary event — the agent clicks the injected button or hyperlink and is redirected — avoiding LLM judge ambiguity. Agents use an observation–action loop receiving AXTree observations and issuing Playwright actions.

Key Contributions

  • Five-dimensional modular attack space of 630 task–injection combinations enabling controlled, per-component analysis of prompt injection success.
  • Reproducible binary success metric (one-click redirect) that eliminates LLM-judge ambiguity present in prior benchmarks.
  • Empirical evaluation of six frontier models (GPT-5, Claude Sonnet 3.7, Gemini 2.5 Flash, GPT-OSS-120B, DeepSeek-R1, LLaMA 4 Maverick) across 3,780 runs.
  • Transferability analysis revealing asymmetric cross-model attack generalization: attacks found on the most robust model (GPT-5) transfer at ~82.5% average to other models, while weak-model attacks transfer at ~39% to GPT-5.
  • Extensible open framework for integrating new attacks, environments, and models.

Results

  • Overall ASR: 25% average across 3,780 runs; GPT-5 13% (±2.6), Claude Sonnet 3.7 20% (±3.1), GPT-OSS-120B 27% (±3.5), Gemini 2.5 Flash 30% (±3.6), LLaMA 4 Maverick 17% (±2.9), DeepSeek-R1 43% (±3.9).
  • Benign utility: GPT-5 89%, Claude Sonnet 3.7 83%, DeepSeek-R1 67%, Gemini 2.5 Flash 61%, GPT-OSS-120B 61%, LLaMA 4 Maverick 22% — higher utility broadly correlates with lower ASR.
  • Interaction vector: Button-based injections account for 77.5% of all successful attacks vs. 22.5% for hyperlinks (~3.5× more effective); GPT-5 ratio is 96.3% buttons.
  • Persuasion principle: Social Proof (18.1%) and Consistency (17.9%) account for the largest shares; Unity (10.4%) the smallest.
  • LLM manipulation method: Adversarial Suffixes (24.5%), CoT injection (23.8%), and Many-shot conditioning (23.8%) dominate; Override/Ignore instructions (11.6%) are least effective.
  • Tailoring: Light lexical tailoring raises ASR from 3.3% → 18.6% on GoCalendar and 6.7% → 16.7% on DashDish across the six models.
  • Transferability: GPT-5 successful attacks transfer to DeepSeek-R1 at 88.8% and Claude Sonnet 3.7 at 90%; DeepSeek-R1 attacks transfer to GPT-5 at only 26%.
  • Location (NetworkIn): About section is most vulnerable (52–59% ASR); location targeting generally reduces ASR except when directing the agent toward an already-vulnerable section.

Limitations

  • Attack surface limited to six cloned websites and textual injection modalities only (image-based injections supported but not evaluated).
  • Tailoring experiments used only light lexical edits, not deeper contextual or user-profile-aware strategies.
  • One-click success metric excludes post-redirect behavior (credential harvesting, data exfiltration).
  • Full dataset run only once; subset re-runs (n=120) showed <3% ASR variance across three runs.
  • No defenses proposed or evaluated.
  • Modular attack decomposition abstracts away organic co-occurrence of persuasion components, which may differ from real-world compound attacks.
  • Code not yet released at time of submission.

Relevance to Agentic AI / LLM Agents

TRAP directly addresses a critical attack surface for deployed web agents: adversarial instructions embedded in dynamic web content that exploit both model-level jailbreak susceptibilities and human-analogous persuasion mechanisms. The finding that even frontier models with strong alignment (GPT-5, Claude Sonnet 3.7) are hijacked in 13–20% of realistic tasks establishes a concrete baseline risk for agentic deployment. The modular attack framework and transferability analysis are particularly actionable for agent security work — showing that red-teaming the strongest available model produces attacks that broadly generalize, and that psychologically grounded persuasion principles (Social Proof, Consistency) are structurally exploitable across model families. This work complements agent capability benchmarks by quantifying the security-capability gap: higher-capability models tend to resist injection better, but no model achieves robustness.