发现浏览器智能代理普遍存在状态不一致漏洞，提出轻量级验证机制防御
Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents
- 通过检测页面结构和布局变化，在执行前验证状态
- 实测10个主流开源代理均有严重状态不一致问题
- 适合自动化测试、网页操作等场景开发者参考
浏览器使用代理广泛应用于日常任务，通过结构化DOM接口或基于页面截图的视觉语言模型实现自动化操作。然而，规划与执行之间的网页状态可能已改变，导致代理基于过时信息执行动作。我们将其视为浏览器代理中的时间检查到使用（TOCTOU）漏洞。动态或恶意网页内容可利用此窗口引发意外行为。本文构建覆盖合成与真实网站的大规模基准测试，评估了10个主流开源代理，发现此类漏洞普遍存在。为此设计了一种轻量级缓解方案：在规划阶段监控DOM与布局变化，并在执行前即时验证页面状态。该方法显著降低不安全执行风险，有效缓解代理的意外副作用。
原文摘要 · Abstract (English)
Browser-use agents are widely used for everyday tasks. They enable automated interaction with web pages through structured DOM based interfaces or vision language models operating on page screenshots. However, web pages often change between planning and execution, causing agents to execute actions based on stale assumptions. We view this temporal mismatch as a time of check to time of use (TOCTOU) vulnerability in browser-use agents. Dynamic or adversarial web content can exploit this window to induce unintended actions. We present a large scale empirical study of TOCTOU vulnerabilities in browser-use agents using a benchmark that spans synthesized and real world websites. Using this benchmark, we evaluate 10 popular open source agents and show that TOCTOU vulnerabilities are widespread. We design a lightweight mitigation based on pre-execution validation. It monitors DOM and layout changes during planning and validates the page state immediately before action execution. This approach reduces the risk of insecure execution and mitigates unintended side effects in browser-use agents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。