Untrusted Content Masking for Web Agents with Security Guarantees

Abstract: Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which intermingles trusted content with untrusted content. This structural entanglement removes the trust boundary on which security guarantees depend, undermining provable defenses for web agents. In this paper, we present Untrusted Content Masking (UCM), a simple and effective approach that restores this boundary in web environments. We leverage a key structural insight: a webpage's Document Object Model (DOM) encodes sufficient information to distinguish trusted from untrusted regions without reading their content. Our framework exploits this by redacting untrusted regions before they reach the agent and routing interaction through a sandboxed interface with strict privilege separation, thereby enabling agents to observe and interact with their environment while remaining isolated from adversarial content. The code is publicly available.

• The paper introduces a secure untrusted content masking strategy that enforces strict privilege separation between trusted and untrusted webpage elements.
• It achieves a 0% attack success rate on prompt injection while preserving 100% benign task utility with moderate cost overhead.
• Automated LLM-based selector inference delivers high-precision masking, enabling scalable application to complex real-world web environments.

Untrusted Content Masking: enforcing security boundaries for LLM web agents

Introduction and Motivation

The adoption of autonomous web agents leveraging LLMs has exposed a significant attack surface for prompt injection exploits, particularly in web contexts where untrusted content (e.g., user-generated posts, third-party reviews) is inherently intermingled with application logic. Existing defenses are either heuristic—yielding no guarantees—or are so restrictive that agent utility is compromised. "Untrusted Content Masking for Web Agents with Security Guarantees" (2607.05277) introduces Untrusted Content Masking (UCM), a system that enforces strict privilege separation between trusted and untrusted webpage content, elevating defenses to a principled, enforceable boundary model with practical utility retention.

System Architecture: UCM and the Quarantined Model

UCM's core insight is that the DOM structure of a webpage generally encodes sufficient information to algorithmically distinguish trusted and untrusted regions, independent of their textual content. UCM intervenes before page rendering by masking untrusted regions with semantic placeholders, ensuring that the Agent's context window never includes attacker-controlled raw content.

Additionally, when legitimate tasks require access to untrusted data (e.g., extracting a review's sentiment), the Agent interacts with a Quarantined Model (Q-Model). The Agent issues structured queries, specifying both the masked element identifier and a restricted return type (boolean, int, float, enum, date), validated on type before responses are returned. This design ensures that only data with explicit, controlled semantic types ever reenters the Agent's reasoning loop; arbitrary instructions or free-form text are categorically excluded.

Figure 1: Schematic for UCM—untrusted webpage content is replaced by labeled placeholders, accessible only through structured Q-Model queries; direct exposure is precluded.

Threat Model and Security Guarantees

UCM explicitly targets the strongest practical attacker: one with full control over untrusted content, capable of supplying adversarial payloads at both the text and image level. The defense assumes an honest site owner correctly labels untrusted regions. Under these assumptions:

• Control-flow attacks (prompt injection, UI deception, indirect prompt manipulation) are provably blocked. Empirically, UCM achieves 0% attack success rate (ASR) on the strengthened WASP benchmark, while maintaining 100% benign task utility.
• Data-flow attacks are strictly reduced to semantic corruption, not code/execution redirection. The Q-Model can be manipulated to return incorrect-but-well-typed values (e.g., false aggregate statistics), but cannot inject new agent behaviors.
• Granular security boundaries align with practical needs; labeling is lightweight (15–30 CSS selectors per site), and incomplete labeling degrades to heuristic-level protection rather than total failure.

Empirical Evaluation: Utility, Cost, and Overhead

The authors evaluate UCM across both synthetic and real-world web environments, employing frontier models (Claude Sonnet 4.5/4.6, GPT-5.4) and a diverse suite of agentic tasks. Key findings are as follows:

• Task utility is maintained: For tasks solvable without untrusted content, achieved utility matches the undefended baseline (i.e., agent completes all intended user goals). For "Untrusted-required" tasks (those requiring untrusted data), utility is equally preserved, as Q-Model queries are sufficiently expressive.
• Moderate cost overhead: Cost increase per task is bounded to 1.05×–1.84×, primarily incurred on untrusted-required tasks due to Q-Model querying. Notably, as model efficiency increases, absolute overhead diminishes; Claude Sonnet 4.6 achieves lower absolute cost than Sonnet 4.5 despite higher relative overhead.

Figure 2: UCM achieves full agent utility up to a 1.84$\times$ cost increase; security is gained with minimal operational burden.

• Application to real-world suites: On the WebArena GitLab benchmark, UCM preserves utility under type-constrained Q-Model queries and fully recovers lost utility by allowing user-gated string outputs for unsolvable tasks, proving compatibility with complex, high-interactivity sites.

Figure 3: On WebArena’s GitLab suite, utility is preserved and cost overhead remains moderate, even on real, complex web applications.

Attack Surface Reduction and Data-Flow Attacks

UCM renders classical prompt injection techniques inoperative, as attacker-controlled content never appears in the Agent’s context. All compromise attempts are forced through the Q-Model’s structured API.

• Control-flow is categorically safe: No route exists for free-form instructions to reach the Agent.
• Residual data-flow attacks: If the attacker can predict the Agent's queries, Q-Model may be coerced to return incorrect structured values, e.g., reporting that malicious_repo matches a target search (see Figure 4).
• Limitations and mitigations: Such attacks are bounded—aggregate manipulation requires significant attacker control; selection hijacking can be ameliorated by parallel candidate evaluation and user confirmation gating for sensitive actions.

Figure 4: Example of a residual data-flow attack—steering the Agent to the wrong repository by manipulating Q-Model output.

Automated Trust Boundary Inference

To enable broad deployment without requiring per-site manual annotation, the authors demonstrate that LLMs—operating solely on sanitized, content-free DOM snapshots—can accurately infer trust boundaries and generate CSS selectors for untrusted region masking.

• High-precision results: On domains including Booking.com, Reddit, and GitLab, LLM-based selector inference achieves F1 scores up to 0.997, with false-negative rates as low as 0.0%.
• No content exposure: DOM sanitization ensures the model never sees attacker content, hardening the labeling phase itself against prompt injection.
• Automated masking scales UCM applicability: Even in the absence of an active honest owner, security boundaries can be inferred with high confidence.

  Figure 5: Automated boundary identification on Booking.com; red-highlighted regions are masked with precision by LLM-inferred selectors.

Implications and Future Prospects

UCM advances the principle of zero-trust by establishing structural, enforceable boundaries within webpages for agentic AI. Its design unlocks practical agent deployment by addressing both the security (provable prompt injection resistance) and utility (task solvability) axes. The approach further enables downstream application of classical information-flow and action-level security techniques (e.g., FIDES, CaMeL) in web settings for comprehensive containment of residual data-flow threats.

Future work should focus on:

• Standardizing trust boundary annotation protocols at the platform or browser level, analogous to CSP for web security.
• Extending automated labeling with active learning—using joint human-LLM feedback to iteratively refine selectors.
• Composing UCM with runtime/theory-driven security policies to formally bound all data-flow compromises.
• Exploring cross-context attacks (e.g., DOM rewrites, XSS) within the honest owner assumption breakdown.

Conclusion

UCM provides a formal, practical mechanism for hardening LLM-powered web agents against the universal challenge of prompt injection. By mapping structural page boundaries and strictly gating agent access to adversarial content, it offers strong, empirically validated security guarantees with moderate, manageable overhead and broad deployment feasibility. This work establishes a new baseline for web agent security models and highlights foundational directions for integrating trustworthy agentic AI in large-scale web infrastructures.