Untrusted Content Masking for Web Agents with Security Guarantees

Abstract

Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which int

Categories

Framework mappings

Suggested from the entry's categories.

@misc{nikolic2026untrusted,
  title = {{Untrusted Content Masking for Web Agents with Security Guarantees}},
  author = {Kristina Nikolić and Egor Zverev and Javier Rando and Matthew Jagielski and Edoardo Debenedetti and Florian Tramèr},
  year = {2026},
  month = jul,
  eprint = {2607.05277},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05277}
}