Prismata: Confining Cross-Site Prompt Injection in Web Agents

🕒 Published (v1): 2026-07-09 06:37 UTC · Source: Arxiv · link

Why this paper was selected

Berkeley (Raluca Popa); principled confinement of cross-site prompt injection in web agents

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Prismata is a system-level defense that enforces contextual least-privilege for autonomous web agents against Cross-Site Prompting (XSP) attacks — the agent-side analog of XSS, where attacker-controlled content on benign sites hijacks agent behavior via prompt injection. It combines DOM-path-based dynamic trust derivation (inspired by the Biba integrity model) with deterministic mechanical confinement, requiring no developer annotations. Across WebArena attack benchmarks, Prismata reduces attack success from 85.5% to 0.7% while preserving most benign utility.

Problem

Autonomous web agents face the web entanglement problem: deriving a security policy requires reading page structure (to understand what an element does), but that structure is intermixed with attacker-controlled content. Model-level defenses (prompt training, detection classifiers) are consistently bypassed by adaptive attacks. Existing system-level defenses either require pre-planned action sequences (e.g., CaMeL), offer only coarse origin-level controls, or need exhaustive per-site developer annotations — none scale to the long tail of arbitrary websites. No prior work provides page-level, annotation-free confinement guarantees.

Method

Prismata operates as a transparent middleware layer between the web agent and the browser, processing each page's rendered DOM before the agent observes or acts on it. It applies three stages:

Action gate. For each interactive element \(e\), Prismata traces its critical path \(\text{path}(e)\) — the full HTML ancestor chain from the DOM root to \(e\). An LLM evaluates only \((\text{path}(e), \text{task})\) to assign a scope label \(\text{cap}_{\text{gate}}(e, \text{task})\). No other DOM content is visible; any injection outside \(\text{path}(e)\) is structurally excluded from this decision.

Biba parsing. Prismata traverses \(\text{path}(e)\) top-down, classifying each ancestor's content origin (developer / user / hosted-party / external) using structural cues (headings, aria-label attributes, developer class names). Inspired by the 1977 Biba integrity model, it enforces no-read-down (children/siblings masked at each depth) and no-write-up (labels locked before the next depth is revealed), so a structural cue at depth \(j\) cascades a trust label to all descendants without querying them — the injection at depth \(j{+}1\) never enters the labeler's context. This yields \(\text{cap}_{\text{biba}}(e, \text{task})\).

Mechanical confinement. The effective capability is: $\(\text{cap}(e, \text{task}) = \min\bigl(\text{cap}_{\text{gate}}(e, \text{task}),\; \text{cap}_{\text{biba}}(e, \text{task})\bigr)\)$ A separate policy model (given only task details, no DOM content) determines which origin classes the task requires; all others are pruned entirely. Enforcement is deterministic code: pruned nodes are removed from the accessibility-tree observation passed to the agent, interactive identifiers for read-only elements are stripped, and every outbound tool call is checked against the capability map before reaching the browser.

Key Contributions

• Formalization of Cross-Site Prompting (XSP) as a distinct attack class analogous to XSS, enabling principled defense design.
• Dynamic trust derivation from structural DOM invariants, producing confinement guarantees without per-site developer annotations.
• Adaptation of the Biba integrity model to DOM traversal: no-read-down / no-write-up prevents label elevation from untrusted content and bounds mislabeling propagation to elements whose critical paths contain the injection.
• Mechanical confinement as a deterministic enforcement layer independent of LLM reasoning, interposing on every agent action.
• Empirical validation of the critical-path and structural-cue assumptions on a 5,664-DOM corpus (2,832 domains, 90,408+ untrusted path instances), showing the residual risk (Case 3) is ~0.1% of paths.

Results

• Attack success rate: 85.5% → 0.7% (average across three WebArena attack templates plus adaptive variants).
• Task completion under attack: 4.5% → 23.0%.
• Benign task success: 29.9% → 26.6% (minimal utility cost).
• Blocks all observed WASP plain-goal attack successes.
• Empirical corpus: only 1.2% (1,086/90,408) of untrusted path instances contain actionable descendants (Case 1 coverage); of those, only 94 (0.10% of full corpus) lack a preceding structural cue (residual Case 3 risk).
• Sites following existing web best practices reduce Case 3 to 0.017% of paths.

Limitations

• Textual modality only: adversarial image perturbation attacks (a known XSP vector) are not addressed; DOM-based permission structure would need to be mapped onto screenshots for extension.
• Within-scope attacks unaddressed: fake reviews influencing product selection when the task legitimately requires reading reviews fall within least-privilege and are outside Prismata's threat model.
• Case 3 residual risk: ~0.1% of paths (attacker content on critical path, no preceding structural cue) cannot be labeled injection-free; mislabeling there is bounded but not eliminated.
• Assumes JavaScript sandboxing: classical XSS (attacker JS executing on the trusted origin) is out of scope; Prismata requires the site to sandbox third-party scripts.
• Evaluated only in WebArena/BrowserGym: generalization to other agent frameworks or real browser deployments is asserted but not empirically measured.

Relevance to Agentic AI / LLM Agents

Prismata directly addresses one of the most critical unsolved security problems for production web agents: indirect prompt injection through untrusted web content. By framing the problem as XSP — a formal analogue to XSS — it enables system-level defenses with bounded confinement guarantees rather than relying on model robustness, which adaptive attacks have repeatedly broken. The approach of isolating per-element critical paths and applying classical integrity models (Biba) to LLM-driven label derivation demonstrates a principled path toward composable, annotation-free agent security. This is directly relevant to any LLM agent framework that operates over open web environments (browser-use, OpenAI Operator-style systems, etc.) and complements ongoing work on tool-use sandboxing and agent privilege separation.