AI浏览代理存在严重安全漏洞，可能被劫持并窃取凭证
The Hidden Dangers of Browsing AI Agents
- 构建首个端到端的浏览代理威胁模型
- 发现提示注入、域名验证绕过等关键漏洞
- 适合关注AI安全与自动化部署的开发者
由大语言模型驱动的自主浏览代理正被广泛用于自动化网络任务，但其对动态内容、工具执行和用户数据的依赖使其面临广阔攻击面。本文首次提出完整的浏览代理安全评估框架，涵盖多层架构中的系统性漏洞。通过白盒分析开源项目Browser Use，揭示了未受信任网页可劫持代理行为并导致严重安全事件，包括提示注入、域名验证绕过及凭据外泄，相关漏洞已披露为CVE，并提供可行的原型攻击。为此，我们提出纵深防御策略，包含输入清洗、规划器-执行器隔离、形式化分析器和会话保护机制，有效防御初始入侵与后续横向移动攻击。
原文摘要 · Abstract (English)
Autonomous browsing agents powered by large language models (LLMs) are increasingly used to automate web-based tasks. However, their reliance on dynamic content, tool execution, and user-provided data exposes them to a broad attack surface. This paper presents a comprehensive security evaluation of such agents, focusing on systemic vulnerabilities across multiple architectural layers. Our work outlines the first end-to-end threat model for browsing agents and provides actionable guidance for securing their deployment in real-world environments. To address discovered threats, we propose a defense in depth strategy incorporating input sanitization, planner executor isolation, formal analyzers, and session safeguards. These measures protect against both initial access and post exploitation attack vectors. Through a white box analysis of a popular open source project, Browser Use, we demonstrate how untrusted web content can hijack agent behavior and lead to critical security breaches. Our findings include prompt injection, domain validation bypass, and credential exfiltration, evidenced by a disclosed CVE and a working proof of concept exploit.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。