CoChat
Sign Up
PreprintCited by 9Web Application Security VulnerabilitiesAdversarial Robustness in Machine LearningPrivacy, Security, and Data Protection

EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage

Open access
Liao, Zeyi, Mo, Lingbo, Xu, Chejian, Kang, Mintong, Zhang, Jiawei, Xiao, Chaowei, Tian, Yuan, Li, Bo +1 more·2024·arXiv
DOI 10.48550/arxiv.2409.11295arXiv 2409.11295
Open this paper in CoChat — free accountOpen PDF

Abstract

Generalist web agents have demonstrated remarkable potential in autonomously completing a wide range of tasks on real websites, significantly boosting human productivity. However, web tasks, such as booking flights, usually involve users' PII, which may be exposed to potential privacy risks if web agents accidentally interact with compromised websites, a scenario that remains largely unexplored in the literature. In this work, we narrow this gap by conducting the first study on the privacy risks of generalist web agents in adversarial environments. First, we present a realistic threat model for attacks on the website, where we consider two adversarial targets: stealing users' specific PII or the entire user request. Then, we propose a novel attack method, termed Environmental Injection Attack (EIA). EIA injects malicious content designed to adapt well to environments where the agents operate and our work instantiates EIA specifically for privacy scenarios in web environments. We collect 177 action steps that involve diverse PII categories on realistic websites from the Mind2Web, and conduct experiments using one of the most capable generalist web agent frameworks to date. The results demonstrate that EIA achieves up to 70% ASR in stealing specific PII and 16% ASR for full user request. Additionally, by accessing the stealthiness and experimenting with a defensive system prompt, we indicate that EIA is hard to detect and mitigate. Notably, attacks that are not well adapted for a webpage can be detected via human inspection, leading to our discussion about the trade-off between security and autonomy. However, extra attackers' efforts can make EIA seamlessly adapted, rendering such supervision ineffective. Thus, we further discuss the defenses at the pre- and post-deployment stages of the websites without relying on human supervision and call for more advanced defense strategies.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper introduces Environmental Injection Attack (EIA), a privacy attack that injects malicious web elements into benign pages to mislead generalist web agents into leaking personally identifiable information (PII) or full user requests. Experiments on SeeAct with Mind2Web-derived PII tasks show up to 70% attack success rate for specific PII and 16% for full-request leakage, with limited detectability or mitigation by tested defenses.

Key findings

  • EIA with Mirror Injection at position P+1 achieved up to 70% ASR for stealing specific PII when using GPT-4V; across all settings, position P+1 had the highest average ASR at 0.39.
  • Standard EIA failed to leak full user requests (0% ASR), but Relaxed-EIA, which relaxes opacity from 0 to 0.2, raised full-request leakage to 16% with GPT-4V at position P-3; the other two LMMs remained at 0%.
  • VirusTotal flagged none of the injected webpages as malicious or suspicious, and three defensive system prompts did not effectively mitigate the attack, with ASRs remaining nearly identical to the default prompt.
  • The attacks preserved agent functional integrity: ASR_pt was very close to ASR for both EIA (MI) and Relaxed-EIA, partly due to the auto-submission mechanism.

Methods

  • Threat model: attackers have no prior knowledge of the user’s task T or previous actions A; targets are either specific PII or the full user request; scenarios include benign developers using contaminated tools or malicious developers.
  • Target agent: SeeAct, a two-stage generalist web agent framework, powered by GPT-4V, Llava-1.6-Mistral-7B, or Llava-1.6-Qwen-72B; experiments used A6000 48GB GPUs.
  • Evaluation data: 177 action steps involving PII selected from Mind2Web, identified with GPT-4/GPT-4o and manually verified, then adapted from MHTML snapshots; metrics include step success rate and ASR, with typed values counted correct at string similarity >0.95.

Limitations

  • Stated in the paper: evaluations are offline using action steps adapted from Mind2Web, not end-to-end real-time interactive web environments; EIA is instantiated only by injecting malicious elements, leaving room for multiple-point, compositional, and multi-turn injections.
  • Evident from the text: the automatic injection script may sacrifice adaptation quality, for example by introducing extra white space when not properly adapted; the study targets SeeAct and three LMM backbones, and ASR is measured at individual action steps rather than full task completion.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2409.11295

Cites

44 of 44 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

4 of 7 cited sources checked · 2 supported · 0 flagged · accuracy not yet measured

  • Interpretationcitation

    Indiscriminate prioritization of instructions over data can potentially compromise the utility of web agents.

    “However, such indiscriminate prioritization of instructions over data (Wallace et al., 2024;Hines et al., 2024) can potentially compromise the utility of web agents, as many instructive messages are embedded within webpage elements (data).”
    Quote in the paperSubstantial claim2 of 2 sources checked
    • cites Wallace et al., 2024 source

      The 'Overview of Ideal Model Behavior' says a web agent should follow aligned webpage instructions, such as a 'Click here' link, while 'Over-refusal Results' identifies never following lower-priority instructions as a risk. This supports the potential utility concern, but the paper does not say that many webpage elements contain instructive messages; it also says it does not expect noticeable degradation in typical real-world use. No page numbers are available in our copy. (LLM, conf=0.83)

      Experimental — accuracy not yet measured
    • cites Hines et al., 2024 source
  • Findingreasoning

    Injections placed near the target elements achieve higher ASR compared to those higher or lower positions.

    “Generally, we observe that injections placed near the target elements achieve higher ASR compared to those higher or lower positions.”
    Quote in the paperSubstantial claim
  • Findingnone given

    The paper's attacks achieve relatively high ASR results on the current SOTA web agent.

    “Besides, while we achieve relatively high ASR results on attacking the current SOTA web agent, it is important to note that web agent technology is still in its early developmental stages and not yet ready for real-life deployment.”
    Quote in the paperSubstantial claim
  • Findingown data

    ASR pt is very close to ASR in both EIA (MI) and Relaxed-EIA, indicating that our attacks barely affect subsequent actions of the web agent.

    “According to Fig. 3, it shows that ASR pt is very close to ASR in both EIA (MI) and Relaxed-EIA, indicating that our attacks barely affect subsequent actions of the web agent, partly due to the autosubmission mechanism we designed.”
    Quote in the paperSubstantial claim
  • Findingreasoning

    Injections just above the target element (position P+1) exhibit the highest ASR on average compared to those placed below.

    “In particular, injections just above the target element, i.e., position P +1 , exhibit the highest ASR on average compared to those placed below.”
    Quote in the paperSubstantial claim
  • May combine two claims. 16
  • Classified as probably not a substantial claim. 11

  • May combine two claims.

    Study design and conductcitation

    The evaluation data is derived from the Mind2Web dataset, which is public and cached offline, eliminating the need for attacks on live websites.

    “Our evaluation data is derived from the Mind2Web dataset (Deng et al., 2023) which is public and cached offline, eliminating the need for attacks on live websites.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites Deng et al., 2023 source

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    The community is actively developing more powerful multimodal models as backbone architectures and implementing sophisticated techniques such as Monte Carlo Tree Search to enhance effectiveness.

    “For instance, the community is actively developing more powerful multimodal models as backbone architectures and implementing sophisticated techniques such as Monte Carlo Tree Search to enhance effectiveness (Putta et al., 2024).”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Putta et al., 2024 source

      Section 2.2, Web Agents (page unavailable), describes agents built around strong existing language-vision models such as GPT4-V and says this paper combines an agent with MCTS to improve performance. The Introduction also reports improved success from its MCTS-based search. The paper does not establish the claim that the community is actively developing more powerful multimodal models as backbone architectures; it describes primarily using pre-existing models. (LLM, conf=0.85)

      Experimental — accuracy not yet measured

  • May combine two claims.

    Findingown data

    Web agents are misled into selecting the injected element but fail to type the full user request into it.

    “Interestingly, upon examining the ASR o , we find that web agents are indeed misled into selecting the injected element as presented in Fig. 25, but fail to type the full user request into them.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    EIA fails consistently across all tested positions and three different backbone models, yielding an ASR of zero for EIA.

    “Our experiments reveal that the EIA fails consistently across all tested positions and three different backbone models, yielding an ASR of zero for EIA.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    With extra effort, attackers can seamlessly adapt the attacks into webpages, making human supervision unreliable.

    “Moreover, we show that with extra effort, attackers can seamlessly adapt the attacks into webpages, making human supervision unreliable.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingreasoning

    Even with α = 0, the injected elements still occupy space on the webpage due to their presence in the DOM tree.

    “Even with α = 0, the injected elements still occupy space on the webpage due to their presence in the DOM tree.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The injected field and the malicious instruction are invisible.

    “Specifically, at the step of filling the recipient name on the website, the web agent is misled into typing the PII into the injected field, which contains the malicious instruction, and both the field and the instruction are invisible.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    Relaxed-EIA can slightly increase the accuracy of selecting the injected element compared to EIA.

    “Besides, we find that Relaxed-EIA can slightly increase the accuracy of selecting the injected element compared to EIA, as shown in App.J.2.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductnone given

    The specific PII used in the evaluation is fabricated, guaranteeing that no actual user data is at risk.

    “Additionally, although the tasks and contained PII categories are based on real user needs, the specific PII used is fabricated, guaranteeing that no actual user data is at risk.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    More performant models can effectively complete tasks but are also more vulnerable to EIA.

    “This suggests that while more performant models can effectively complete tasks, they are also more vulnerable to EIA, potentially leading to the leakage of the user PII.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Attacks that are not well adapted for a webpage can be detected through careful human inspection.

    “Notably, attacks that are not well adapted for a webpage can be detected through careful human inspection, leading to our discussion about the trade-off between security and autonomy.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The full request contains additional information beyond specific PII, and leaking it could lead to even more serious privacy risks.

    “Importantly, the full request contains additional information beyond specific PII, and leaking it could lead to even more serious privacy risks (Sec.3.2).”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The full request contains additional information beyond specific PII.

  • May combine two claims.

    Interpretationown data

    Malicious websites employing these attack methods can steal users' private information without noticeably affecting the agent's functional integrity or the user interaction experience.

    “This finding suggests that malicious websites employing these attack methods can steal users' private information without noticeably affecting the agent's functional integrity or the user interaction experience.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    EIA with opacity α=0 only affects the action grounding stage without influencing the action generation stage.

    “Hence, the compromised webpage h * can only affect the action grounding (Eq. 3) without influencing the action generation (Eq.2).”
    • Also stated in: § 4.2 EIA TO STEAL SPECIFIC PII · plain
      “Note that, with the opacity value α = 0, the injections are invisible and the screenshot appears benign.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Targeted attacks that alter other agents' behaviors are beyond the reach of traditional web attacks.

    “Such targeted attacks are beyond the reach of traditional web attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductown data

    A threshold of 0.95 was selected after empirical testing as the most accurate for handling spacing issues in several full user requests within the Mind2Web dataset.

    “We select a threshold of 0.95 after empirical testing, as this value proved to be the most accurate in handling spacing issues in several full user requests within the Mind2Web dataset.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    Distinguishing between benign and malicious elements in such cases is difficult.

    “Distinguishing between benign and malicious elements in such cases is difficult.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Many legitimate web elements initially have zero opacity for reasons like transitions or animations, before becoming visible and interactive.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    Extra attackers' efforts can make EIA seamlessly adapted, rendering human supervision ineffective.

    “However, extra attackers' efforts can make EIA seamlessly adapted, rendering such human supervision ineffective.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    EIA fails to steal the full request because action grounding is predominantly guided by the reasoning steps and generated textual description, while action generation remains unaffected by the attack.

    “We identify that the failure occurs because action grounding is predominantly guided by the reasoning steps and the generated textual description (e, o, v) from the action generation stage.”
    • Also stated in: § Additional information · plain
      “However, action generation remains unaffected by the attack, as it only processes the screenshot (Eq.2), and not the compromised HTML with the injection.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    Blanket exclusion of all such elements could disrupt the website's intended flow or functionality, resulting in a poor user experience.

    “Blanket exclusion of all such elements could disrupt the website's intended flow or functionality, resulting in a poor user experience.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductown data

    The study conducts offline evaluations using action steps adapted from Mind2Web.

    “In our work, we conduct offline evaluations using action steps adapted from Mind2Web, following their methods to assess step success rate and designing ASR for each action step containing PII.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Mind2Web

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationown data

    EIA is challenging to detect and mitigate.

    “Additionally, by evaluating the detectability and testing defensive system prompts, we indicate that EIA is challenging to detect and mitigate.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The study instantiates EIA by injecting malicious elements into web environments, but this represents just one possibility.

    “Additionally, we instantiate EIA in this work by injecting malicious elements into web environments, but this represents just one possibility.”
    Quote in the paperNot a substantial claim
23 of 23

  • The authors state this as an assumption.

    Attackers have no prior knowledge of the user's task T or the previously executed actions A.

    “We assume that attackers have no prior knowledge of the user's task T or the previously executed actions A.”

  • The paper relies on this without support.

    Web tasks such as booking flights usually involve users' personally identifiable information (PII).

    “However, web tasks, such as booking flights, usually involve users' personally identifiable information (PII), which may be exposed to potential privacy risks if web agents accidentally interact with compromised websites—a scenario that remains largely unexplored in the literature.”
    “On the other hand, many web tasks like booking flights require sensitive PII, such as phone numbers, and credit card details”

  • The paper relies on this without support.

    Many legitimate web elements initially have zero opacity for reasons like transitions or animations, before becoming visible and interactive.

    “However, many legitimate elements initially have zero opacity for reasons like transitions or animations, before becoming visible and interactive.”

  • The authors state this as an assumption.

    Websites can be compromised either by benign developers using contaminated development tools or by malicious developers intentionally injecting malicious content.

    “We consider two realistic attack scenarios where websites are compromised:”
    “(1) The website developers being benign but using contaminated development tools.”
    “(2) The website developers being malicious.”

  • The authors state this as an assumption.

    The attack should not impede the agent's ability to complete the user's intended task normally.

    “Moreover, the attack should not impede the agent's ability to complete the user's intended task normally; otherwise, the user may easily detect it and blacklist the website.”

  • The paper relies on this without support.

    Traditional web attacks can leak specific PII that users type into particular fields.

    “In summary, under the same threat model aforementioned, traditional web attacks, such as obfuscated JavaScript or injecting transmission scripts into HTML forms, can leak specific PII that users type into particular fields.”

  • The paper relies on this without support.

    Web agent technology is still in its early developmental stages and not yet ready for real-life deployment.

    “Besides, while we achieve relatively high ASR results on attacking the current SOTA web agent, it is important to note that web agent technology is still in its early developmental stages and not yet ready for real-life deployment.”

  • The paper relies on this without support.

    The field of web agents is rapidly evolving, with significant research efforts being invested.

    “Nevertheless, the field of web agents is rapidly evolving, with significant research efforts being invested.”

  • The paper relies on this without support.

    The full request contains additional information beyond specific PII.

    “Importantly, the full request contains additional information beyond specific PII, and leaking it could lead to even more serious privacy risks (Sec.3.2).”

  • The paper relies on this without support.

    The user's full request is not typed directly on the webpage when real users directly browse the internet.

    “Since this request is not typed directly on the webpage, traditional attacks designed to target user-typed PII (e.g., recipient name in Fig. 1) cannot access or leak it.”
    “This user full request is a high-level instruction sent to the web agent when using web agents to interact with the websites and won't be typed on the webpage if real users directly browse the internet, making it impossible to be leaked by traditional web attacks.”
10 of 10

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • GPT-4V Mirror Injection variance conflicts with its ASRs

    Minor

    The table reports a variance of 0.461 for this row, but its eight position-specific ASRs give a population variance of approximately 0.044 (or 0.050 using sample variance). Neither matches the reported value.

1 of 1

Cites

Flagged first, then by citations

5 of the 49 references couldn’t be matched to a known paper.

Research works printed but not linked: 3

  1. Curran Associates, Inc., 2023. URL https://proceedings.neurips.cc/paper_files/paper/2023/file/ 5950bf290a1570ea401bf98882128160-Paper-Datasets_and_Benchmarks. pdf.
  2. Curran Associates, Inc., 2023c. URL https://proceedings.neurips.cc/paper_files/paper/2023/ file/6dcf277ea32ce3288914faf369fe6de0-Paper-Conference.pdf.
  3. Curran Asso- ciates, Inc., 2023. URL https://proceedings.neurips.cc/paper_files/paper/ 2023/file/fd6613131889a4b656206c50a8bd7790-Paper-Conference.pdf.

Cited by

Sorted by citations

Related

Authors
Liao, Z., Mo, L., Xu, C., Kang, M., Zhang, J., Xiao, C., Tian, Y., Li, B., & Sun, H.
Affiliations
  • University of Wisconsin–Madison (US)
  • University of Illinois Urbana-Champaign (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2024
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2409.11295
arXiv
2409.11295
OpenAlex
W4403885104
Cited by
1
References
49
Citations by year
2026: 1
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
Keywords
privacy leakage, personal data exposure, adversarial attacks, threat model, security-privacy trade-off, defense strategy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-29.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-29.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review