New method protects AI agents from malicious web content
What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics
Cryptography and Security
Summary
AI programs that browse the web for users can be tricked by fake or harmful text on webpages, causing them to do things they shouldn’t. The authors show that this happens because AI agents treat all web content the same way, ignoring important rules websites use to keep users safe. They created a tool called Intact that helps AI agents understand where web content really comes from and treats each webpage piece carefully. This reduces risks by asking users before acting on doubtful content and stopping most attacks, without much trouble to the webpage’s normal use.
What this means in practice
- •For ai system developers: Build AI agents that safely browse the web by using precise content origin tracking and user approval before risky actions.
- •For web security engineers: Integrate web semantics understanding into browser-based AI tools to reduce risks from misleading or malicious injected content.
Authors
Umar Iqbal
Abstract
AI agents increasingly browse the web on users' behalf, yet they consume webpages as screenshots or text, exposing their LLMs to unvetted third-party content. Browsers enforce semantics under which what an element can do depends on what it is and where it comes from, not on what it says. Agents flatten these semantics, so injected text can persuade the LLM to exercise the user's authority for content that has none. As LLMs remain easy to persuade, the agent's interface to the web must itself ensure the integrity of what the agent reads, interprets, and does. We propose Intact, which runs on an unmodified browser. Intact builds GenTree, a bespoke representation that captures provenance and web semantics. Intact passes the page via GenTree to the LLM one element at a time, so the LLM decides on each element without any other element's text. Its harness executes each step only within the capabilities of the step's element and asks the user before acting on third-party content. On 1,270 real webpages, GenTree attributes 2.3x as many elements to third parties as the browser, which misattributes 58.7% of them to the first party. On 1,091 of these webpages with injected attacks, only 12.8% of attacks get through Intact's planner, each at most as a consent request, against 73.1% for a conventional planner. Isolation disrupts functionality on only 3.7% of tasks, and a parallel schedule could remove most of its added latency.