Verifiable approval cards stop browser AI security attacks
The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
Cryptography and Security
Summary
Some internet browsers that use AI assistants can perform actions for users, but these can be tricked by fake or misleading approval messages. The authors created a new system called the Verifiable Action Card (VAC) that shows users clear, trustworthy details about what actions the browser will perform before asking for approval. By separating this approval from the webpage and linking it directly to the actual action, VAC prevents attackers from fooling users. Tests show VAC stopped all attempted attacks without blocking real user tasks.
What this means in practice
- •For browser developers: Build browsers that prevent AI agents from executing harmful actions by verifying user approval outside webpage control.$Commercial implications: Supports creating secure AI-enabled browsers that protect users from deceptive prompts, a market need for safer browsing experiences.
- •For security operation teams: Defend against attacks that misuse user sessions in autonomous browsing agents by ensuring approval matches exact actions.
Authors
Hasnain Irshad, Anam Mughees, Neelam Mughees, Abdullah Mughees, Imtiaz Ali Soomro
Abstract
Agentic browsers can execute security-sensitive actions under a user's authenticated session, making indirect prompt injection and deceptive confirmation interfaces a direct threat to action integrity. Existing human-in-the-loop (HITL) safeguards are insufficient when the approval prompt itself can be influenced by untrusted page content or model-generated text. We present the \emph{Verifiable Action Card} (VAC), an architectural defence that reconstructs approval information from the ground-truth pending browser action and trusted intent provenance, renders it out-of-band in the trusted browser chrome, and binds approval to the exact action re-verified at dispatch. VAC combines provenance fencing, a ground-truth action descriptor, default-deny confirmation, provenance-aware risk gating, and execution binding. We implement VAC in a complete agentic browser and evaluate it on a 24-scenario benchmark covering confused-deputy attacks, Lies-in-the-Loop dialog forging, indirect prompt injection, adaptive action substitution, provenance evasion, and legitimate tasks. Across the evaluated LLMs, attack success without VAC ranges from $68\%$ to $100\%$, whereas VAC reduces attack success to $0\%$ on every model, with $78\%$ legitimate-task completion and a $0\%$ false-block rate. These results show that grounding approval in the action that will actually execute provides architectural protection against security failures that prompt-level defences and conventional HITL confirmation cannot reliably prevent.