Adaptive webpage injections bypass page guards while agents finish user tasks

BrowseSafe++ starts from webpages containing suspected adversarial instructions, then builds clean controls around the same tasks and surrounding content. Its 38,675 page pairs include 32,187 based on injections observed on production pages, with the surrounding pages reconstructed to protect private information. The corpus spans HTML, Markdown, accessibility trees and screenshots. Observed malicious text is not evidence that a public browser agent executed the requested malicious action in production.

BrowseSafe-Adapt then lets attackers revise their page injection after seeing how a target browser agent behaves, up to 64 attempts in the selected tests. Directly replayed baseline attacks succeeded on relatively few scenarios; some adapted variants reached much higher experimental success. A tested guard left an 84.18% success rate in one 64-attempt Gemini configuration. This number must remain attached to its specific model, attempts, task distribution and guard settings. It is not an estimated success rate for arbitrary websites.

The central finding concerns side effects hidden behind normal-looking completion. The researchers report that 182 of 194 successful state-changing attacks also completed the legitimate task. Meanwhile, detectors can mistakenly reject clean pages, reducing task utility. Classifying page text, tracking an agent's chosen actions and enforcing permissions on external state changes are separate checks. Better injection detection alone cannot certify that an approved transaction is safe.