Prismata: Confining Cross-Site Prompt Injection in Web Agents

Abstract

Autonomous web agents promise to automate everyday browsing tasks, but inherit one of the web's oldest attack surfaces. Cross-Site Scripting proved that mixing trusted and untrusted content is dangerous, even on benign pages. Agents resurface this risk by interpreting natural language as instructions, allowing third-party and user-generated content to hijack the agent via prompt injection. The core challenge is that deriving a task-specific security policy requires reasoning over page structure

Categories

Framework mappings

Suggested from the entry's categories.

@misc{villa2026prismata,
  title = {{Prismata: Confining Cross-Site Prompt Injection in Web Agents}},
  author = {Corban Villa and Alp Eren Ozdarendeli and Sijun Tan and Raluca Ada Popa},
  year = {2026},
  month = jul,
  eprint = {2607.08147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.08147}
}