为浏览器AI代理设计安全沙箱，防提示注入攻击
ceLLMate: Sandboxing Browser AI Agents
- 在HTTP层实现沙箱，通过网络请求拦截控制操作
- 在WASP基准上阻断攻击，延迟增加7.25%至15%
- 适用于需要高安全性的自动化网页任务场景
浏览器使用型智能体（BUAs）能以类人方式与网页交互，如点击、滚动、填表和跳转页面。尽管可自动化重复性在线任务，但易受提示注入攻击，导致泄露隐私或执行未授权操作。我们提出ceLLMate，一种浏览器级沙箱框架，限制智能体的环境权限，缩小攻击影响范围。针对BUAs的根本挑战——对点击、按键等底层UI操作编写并执行安全策略困难且易出错，我们的核心思路是于HTTP层实施沙箱，因为所有有副作用的UI操作最终都会触发向网站后端的网络通信。我们实现ceLLMate为无侵入式浏览器扩展，并在WASP基准测试中验证其可有效阻止提示注入攻击，仅引入7.25%–15%的延迟开销。
原文摘要 · Abstract (English)
Browser-using agents (BUAs) are an emerging class of AI agents that interact with web browsers in human-like ways, including clicking, scrolling, filling forms, and navigating across pages. While these agents help automate repetitive online tasks, they are vulnerable to prompt injection attacks that trick an agent into performing undesired actions, such as leaking private information or issuing unintended state-changing requests. We propose ceLLMate, a browser-level sandboxing framework that restricts the agent's ambient authority and reduces the blast radius of prompt injections. We address the semantic gap challenge that is fundamental to BUAs -- writing and enforcing security policies for low-level UI tools like clicks and keystrokes is brittle and error-prone. Our core insight is to perform sandboxing at the HTTP layer because all side-effecting UI operations will result in network communication to the website's backend. We implement ceLLMate as an agent-agnostic browser extension and demonstrate how it enables sandboxing policies that block prompt injection attacks in the WASP benchmark with 7.25--15% latency overhead.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。