Intact preserves web-element origin to constrain agent actions

An agent reading a flattened webpage can mistake text from a third-party element for instructions backed by the page owner or user. Intact introduces GenTree, a representation that retains which script created or changed each DOM element and checks whether an action is compatible with the element's actual web capabilities. The paper describes manipulated pages that elicit unsafe planning in a baseline and a substantial decrease when origin provenance is preserved.

Its evaluation counts reaching a consent stage, not every unauthorized final action. The method also has a measured benign-disruption rate and depends on reliable browser instrumentation, especially at authenticated third-party widgets. It therefore supports a specific origin-aware defense principle without proving universal protection from indirect prompt injection.

The origin issue appears when a third-party widget contributes page text that an agent interprets as the host site's instruction. GenTree retains provenance that flattened rendered content would otherwise erase. The reported outcome measures reaching a consent stage under controlled injections; it is narrower than completing an unauthorized transaction. Browser instrumentation errors and genuine site-authorized widget actions remain important counterexamples.