Web智能体因记忆被篡改而易受攻击，可诱使其执行恶意任务。
Context manipulation attacks : Web agents are susceptible to corrupted memory
- 通过操纵智能体外部记忆，实现对任务规划的隐蔽污染。
- 攻击成功率比传统提示注入高3倍，隐私泄露任务成功率提升17.7%。
- 适用于研究智能体安全或开发对抗防御的开发者。
自主网络导航智能体将自然语言指令转化为浏览器操作序列，广泛应用于电商、信息检索和内容发现等复杂任务。由于大语言模型（LLM）无状态特性，这些智能体依赖外部记忆系统维持交互上下文。与集中式系统中安全存储在服务端的上下文不同，智能体记忆常由客户端或第三方应用管理，存在显著安全隐患。近期已有生产系统因此被攻破。本文提出并形式化了“计划注入”这一新型上下文操纵攻击，通过针对脆弱的上下文机制污染智能体内部任务表示。对两个主流智能体Browser-use和Agent-E的系统性评估表明，计划注入可绕过强健的提示注入防御，攻击成功率最高达传统提示攻击的3倍。此外，“上下文链式注入”通过构建合法用户目标与攻击者目标之间的逻辑桥梁，使隐私数据窃取任务的成功率提高17.7%。研究结果强调，安全记忆处理必须成为智能体系统设计的首要考量。
原文摘要 · Abstract (English)
Autonomous web navigation agents, which translate natural language instructions into sequences of browser actions, are increasingly deployed for complex tasks across e-commerce, information retrieval, and content discovery. Due to the stateless nature of large language models (LLMs), these agents rely heavily on external memory systems to maintain context across interactions. Unlike centralized systems where context is securely stored server-side, agent memory is often managed client-side or by third-party applications, creating significant security vulnerabilities. This was recently exploited to attack production systems. We introduce and formalize "plan injection," a novel context manipulation attack that corrupts these agents' internal task representations by targeting this vulnerable context. Through systematic evaluation of two popular web agents, Browser-use and Agent-E, we show that plan injections bypass robust prompt injection defenses, achieving up to 3x higher attack success rates than comparable prompt-based attacks. Furthermore, "context-chained injections," which craft logical bridges between legitimate user goals and attacker objectives, lead to a 17.7% increase in success rate for privacy exfiltration tasks. Our findings highlight that secure memory handling must be a first-class concern in agentic systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。