Prismata: Confining Cross-Site Prompt Injection in Web Agents

Abstract: Autonomous web agents promise to automate everyday browsing tasks, but inherit one of the web's oldest attack surfaces. Cross-Site Scripting proved that mixing trusted and untrusted content is dangerous, even on benign pages. Agents resurface this risk by interpreting natural language as instructions, allowing third-party and user-generated content to hijack the agent via prompt injection. The core challenge is that deriving a task-specific security policy requires reasoning over page structure that is entangled with the attacker's content. We present Prismata, a defense enforcing contextual least privilege for web agents, constraining both what the agent sees and what it can do. Prismata's dynamic trust derivation produces permission labels for page content, with structural confinement guarantees, inspired by classical integrity models, that bound any labeling errors so that labels can only decrease in privilege and mislabelings are bounded. Prismata's mechanical confinement enforces these labels by redacting content and restricting agent capabilities. Importantly, these mechanisms require no developer annotations, so Prismata supports the long tail of websites. Across recent published web agent attacks, including adaptive variants, Prismata substantially reduces attack success while preserving benign task utility.

• The paper presents a multi-layered, context-aware defense that reduces cross-site prompt injection success from 85.5% to 0.7%.
• It employs action gating and Biba-inspired provenance labeling to restrict untrusted content and enforce dynamic least-privilege policies.
• Empirical analysis on large-scale web snapshots validates scalability and effectiveness with only a modest impact on benign task success.

Prismata: A Contextual Least-Privilege Defense for Web Agents against Cross-Site Prompt Injection

Motivation and Threat Model

The emergence of autonomous web agents executing complex, multi-step web browsing tasks has introduced an expanded attack surface reminiscent of classical web security problems. The key threat addressed is Cross-Site Prompting (XSP), a class of attacks analogous to Cross-Site Scripting (XSS), wherein adversaries inject natural language (or other content) into otherwise benign web pages, aiming to hijack autonomous agents by inducing them to perform malicious actions outside the user's intended task scope. Empirical evidence demonstrates that such indirect prompt injections—placed in user reviews, third-party embeds, or advertisements—can result in confidential information leakage or mounting unauthorized actions, with natural language and image-based payloads bypassing traditional sanitization and sandboxing controls.

Figure 1: Cross-Site Prompting (XSP), where malicious natural language content in a product review hijacks an agent to exfiltrate confidential data.

A critical challenge highlighted is the web entanglement problem: web agents must interpret and act on dynamic, mixed-origin page content, yet determining the security implications of an action requires reasoning over complex, interleaved site structure and untrusted data. Unlike tool APIs, where semantic meaning is formal and clearly partitioned, the semantics of a web action (e.g., click(id)) can only be elucidated by jointly analyzing site structure, content ancestry, and user-originated data.

Figure 2: Web entanglement: agent actions are context-dependent, requiring disentanglement of structural site semantics from untrusted content for security.

System Architecture and Security Design

Prismata introduces a multi-layered, context-aware defense for web agents, enforcing dynamic least-privilege on both observations presented to the agent and the action space they can target. This is achieved via system-level interposition between the agent and the browser, capturing the rendered DOM, inferring granular provenance and permission labels, and applying mechanical enforcement to redact or downgrade capabilities prior to agent access.

Figure 3: Prismata is deployed as a policy layer between the web agent and the browser, leveraging DOM and accessibility tree representations for fine-grained filtering.

The core technical flow comprises:

• Action Gate: For each interactive DOM element, Prismata traces its critical ancestor path and evaluates, task-conditioned, whether access is required. This decision is performed per-element, with access to only structural features and not global state, drastically limiting injection influence.
• Biba Parsing: Provenance labels (developer, user, hosted-party, external) are derived via recursive, no-read-down traversals inspired by the Biba integrity model. Trust label assignment is monotonic, strictly preventing privilege escalation and confining mislabeling to subtrees.
• Mechanical Confinement: Policy models determine allowed provenance classes per user task, and enforced capabilities (view-only or interactable) are mechanically imposed, with pruned content entirely removed from the agent's observable state.

The architecture is agnostic to site developer annotation—a critical property for scalability across arbitrary web domains—and robust to adaptive, content-based adversarial manipulations that would bypass conventional model-level or origin-level mitigations.

Empirical Security Analysis

The security model relies on two empirical observations, validated across large-scale web snapshots (Common Crawl, Mind2Web):

• Untrusted content rarely forms critical action paths: Of over 90,000 untrusted DOM paths sampled, only 1.2% intersect actionable descendants.
• Structural cues precede untrusted content: For actionable untrusted paths, 91.3% are preceded by clear structural signals (DOM container classes, headers, accessibility attributes, etc.), allowing deterministic pruning by Biba parsing. This reduces exposure for the action gate evaluation and bounds residual risk to $<$0.1% of cases.

  Figure 4: Coverage analysis of critical-path and structural-cue conditions across large-scale site samples, showing most paths are amenable to Prismata confinement.

Caching lineage-based label decisions enables practical deployment latency and cost, given that DOM structure recurs heavily across sites and tasks.

Figure 5: Caching effectiveness of critical-path labels across site snapshots, indicating high amortization of labeler cost.

Attack Evaluation and Defense Effectiveness

Prismata's efficacy is systematically benchmarked against state-of-the-art XSP and prompt-injection attacks, including pop-up overlays, completion spoofing, instruction-ignoring payloads, and adaptive adversaries using prior knowledge of deployed defenses.

Figure 6: Illustration of pop-up attack template classes evaluated against Prismata, including malicious shortcuts, completion forgeries, and instruction override injections.

Key numerical results:

• Average attack success rate is reduced from 85.5% to 0.7% ($\Delta$ASR $=-84.8$ pts).
• Under attack, agent task completion increases from 4.5% to 23.0% ($\Delta$TSR $=+18.5$ pts).
• Benign task success is only modestly impacted: from 29.9% without Prismata to 26.6% with defense enabled.
• Under adaptive attacker scenarios and WASP benchmarks, Prismata eliminates all observed end-to-end XSP attack successes.

These numbers indicate strong system-level confinement properties, especially in adversarial settings where model-internal mitigations fail due to adaptive or knowledge-driven attack strategies.

Labeling Accuracy and Utility Preservation

Prismata's security guarantees are only as effective as the underlying labelers deployed for provenance and capability assignment. Validation studies compared Prismata (with various LLM labelers) against expert-annotated ground truth.

Figure 7: Allowed-element labeling metrics (precision, recall, F1) for six evaluated LLM-based provenance/capability labelers.

Figure 8: Per-site allowed-element labeling performance for GPT-5.4-nano: precision $\geq95\%$ is maintained on all domains, with recall and F1 robust except at pathological points.

Numerical highlights:

• All candidate models exceed $93\%$ precision and $87\%$ F1 across diverse site samples.
• The most conservative model attains $98.7\%$ precision at some cost to recall.
• Precision is prioritized over recall to minimize failures that would admit more content than the intended security policy allows.

Cost and latency overhead are mitigated by label caching and by specializing the runtime for critical-path evaluation, yielding acceptable end-to-end overhead for practical agent deployment.

Figure 9: Deployment cost and latency breakdown with and without Prismata, including the amortization benefits of KV and request-level caching on inference costs.

Relationships to Prior Work and Limitations

Prismata differs fundamentally from model-level defenses, which display high false negatives under adaptive attacks; and from tool-level system approaches, which are impractical for open-ended, data-dependent web navigation. Origin-level policies or developer-manual annotation are unscalable, and typical input sanitization and CSP/iframe sandboxing cannot address the LLM execution model, where any textual content may be interpreted as privileged instruction.

Limitations include:

• Integrity prioritization over utility: Conservative label propagation causes occasional legitimate task elements to be pruned, but over-permissiveness is systematically prevented.
• Dependence on underlying LLMs for labeling accuracy: Advances in instruction-following and fine-tuning for provenance/capability discrimination directly benefit Prismata's robustness.
• Scope limited to textual DOM modality: Multimodal or screenshot-based web agents require further extension of provenance and capability controls.
• Incomplete coverage for privilege-required untrusted tasks: In scenarios demanding full agent interaction with untrusted content, delegating suspicious actions to quarantined subagents is necessary.

Theoretical and Practical Implications

Prismata provides a formal security model for contextual, path-restricted privilege assignment in web environments—a necessary development as LLM-based automation becomes pervasive in both consumer and enterprise settings. The working assumption is that widespread adoption of web design conventions (i.e., semantic UI organization, explicit provenance labeling) will further reduce residual risk, potentially enabling industry-recognized standards for agent-accessible web interfaces.

Mechanistically, layering action gating with Biba-inspired provenance assignment delivers strong monotonic isolation of adversarial content, and the system's cache-friendly runtime design ensures practical scalability. Since neither model-level nor static origin/domain-level separation are sufficient for the dynamic, data-driven context of web interactions, Prismata delineates a path forward for system-level mediation in open-world LLM/agent deployments.

Conclusion

Prismata delineates a rigorous approach for confining XSP attack surfaces in autonomous web agents, substantially reducing the effective attack success rate while preserving most legitimate agent utility. Its empirical grounding in real-world web analytics, formalizing of privilege and provenance assignment, and system-level enforcement without site-specific developer dependence represent a significant advance in realizing contextual least-privilege for web-based AI automation. Future directions include expansion to multimodal agent interfaces, tighter integration with evolving web standards, and reinforcement learning pipelines for improving labeling model robustness.

---

Citation: ["Prismata: Confining Cross-Site Prompt Injection in Web Agents" (2607.08147)]