用网页代码埋藏指令，让大模型代理自动泄露密码或点广告。
Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree
- 通过修改网页HTML的可访问性树，间接操控大模型代理行为。
- 在真实网站上实现90%以上成功率，完成登录信息窃取和强制点击。
- 适合关注AI代理安全、自动化测试与攻防研究的人阅读。
本研究揭示基于大语言模型的网页导航代理虽具强大自动化能力，却易受间接提示注入（IPI）攻击。攻击者可在网页HTML中嵌入通用对抗性触发器，利用代理通过可访问性树解析网页的机制，劫持其行为，导致非预期或恶意操作。借助贪心坐标梯度（GCG）算法与基于Llama-3.1的Browser Gym代理，实验在真实网站上实现了高成功率的定向与泛化攻击，包括登录凭证窃取和强制广告点击。实证结果凸显了关键安全风险，表明随着大模型驱动的自主网页代理广泛应用，亟需强化防御措施。相关系统代码（https://github.com/sej2020/manipulating-web-agents）已开源，许可证为MIT，配套演示网站（http://lethaiq.github.io/attack-web-llm-agent）可供体验。
原文摘要 · Abstract (English)
This work demonstrates that LLM-based web navigation agents offer powerful automation capabilities but are vulnerable to Indirect Prompt Injection (IPI) attacks. We show that adversaries can embed universal adversarial triggers in webpage HTML to hijack agent behavior that utilizes the accessibility tree to parse HTML, causing unintended or malicious actions. Using the Greedy Coordinate Gradient (GCG) algorithm and a Browser Gym agent powered by Llama-3.1, our system demonstrates high success rates across real websites in both targeted and general attacks, including login credential exfiltration and forced ad clicks. Our empirical results highlight critical security risks and the need for stronger defenses as LLM-driven autonomous web agents become more widely adopted. The system software (https://github.com/sej2020/manipulating-web-agents) is released under the MIT License, with an accompanying publicly available demo website (http://lethaiq.github.io/attack-web-llm-agent).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。