Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

May combine two claims.

T1 attains the highest objective-level ASR alongside limited TDR.

“A large subset (e.g., T1, E3) lands in Stealthy Parasitism, with T1 attaining the highest objective-level ASR alongside limited TDR.”

May combine two claims.

Switching from GPT-5 to Gemini-2.5-Flash raises IPI ASR by 26.49 points on NanoBrowser and 6.2 points on BrowserUse.

“switching from GPT-5 to Gemini-2.5-Flashraises IPI ASR by 26.49 points on NANOBROWSER and 6.2 points on BROWSERUSE”

Classified as probably not a substantial claim.

StakeBench instantiates adversarial benchmark cases from a library of 22 reusable attack templates.

“StakeBench instantiates adversarial benchmark cases from a library of 22 reusable attack templates.”

May combine two claims.

BrowserUse consistently exhibits higher TDR and substantially higher BIR on average than NanoBrowser.

“BROWSERUSE consistently exhibits higher TDR and substantially higher BIR on average”

May combine two claims.

When the injected objective is categorically distinct, BrowserUse ASR drops to 5.56% while TDR and BIR rise to 27.78% and 26.39%, and NanoBrowser ASR remains at 27.78% with a TDR of 48.61%.

“When the injected objective is categorically distinct, the failure shape itself shifts: BROWSERUSE ASR drops to 5.56% while TDR and BIR rise to 27.78% and 26.39%, and NANOBROWSER ASR remains at 27.78% but is accompanied by a TDR of 48.61%.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the baseline condition, the Pack of 15 Diet Pepsi variant is the least preferred option.

“The manipulation targets the Pack of 15 variant, which is the least preferred option under the baseline condition.”

May combine two claims.

BrowserUse-Gemini reaches the highest TDR (45.09%) and BIR (28.85%) across configurations.

“with BROWSERUSE-Gemini reaching the highest TDR (45.09%) and BIR (28.85%) across configurations.”

May combine two claims.

Removing transaction authorization raises BIR (from 13.19% to 19.44%) while leaving TDR moderate.

“removing transaction authorization raises BIR (13.19% to 19.44%) while leaving TDR moderate”

May combine two claims.

Across all agent-backbone configurations, TDR and BIR are consistently higher under attack than in the benign condition, confirming that the failure rates reported in the main experiments reflect attack-induced degradation rather than baseline agent unreliability.

“Across all agent-backbone configurations, TDR and BIR are consistently higher under attack than in the benign condition, confirming that the failure rates reported in the main experiments reflect attack-induced degradation rather than baseline agent unreliability.”

May combine two claims.

Seller-targeted attacks yield the highest ASR for both agent systems and also produce the highest TDR.

“Seller-targeted attacks yield the highest ASR for both agent systems and also produce the highest TDR”

Probably not a substantial claim: may not pass S3 (load-bearing).

StakeBench contains 22 hand-crafted adversarial templates.

“StakeBench contains 22 hand-crafted adversarial templates”

May combine two claims.

P4 simultaneously exhibits high ASR, high TDR, and one of the largest BIR observed in the benchmark.

“P4 occupies the Compounded Failure region, simultaneously exhibiting high ASR, high TDR, and one of the largest BIR observed in the benchmark.”

May combine two claims.

High-similarity cases yield the highest ASR (70.83% on BrowserUse, 79.17% on NanoBrowser), while low-similarity cases are substantially less vulnerable (30.56% and 27.78%).

“high-similarity cases yield the highest ASR (70.83% on BROWSERUSE, 79.17% on NANOBROWSER), while low-similarity cases are substantially less vulnerable (30.56% and 27.78%).”

May combine two claims.

StakeBench contains 22 adversarial templates, comprising 9 DPI templates and 13 IPI templates, instantiated over the 12 product categories listed in Table 7.

“StakeBench contains 22 adversarial templates, comprising 9 DPI templates and 13 IPI templates, instantiated over the 12 product categories listed in Table 7.”

May combine two claims.

Removing situational framing leaves BIR unchanged but raises TDR sharply (from 11.11% to 29.86%).

“removing situational framing leaves BIR unchanged but raises TDR sharply (11.11% to 29.86%)”

Probably not a substantial claim: may not pass S3 (load-bearing).

The full benchmark comprises 3,168 attacked runs across all agent-backbone pairs.

“The full benchmark comprises 3,168 attacked runs across all agent-backbone pairs.”

May combine two claims. The quote only partly states this claim.

The LLM judge and human annotation show percent agreement of 90.63% for ASR, 89.88% for TDR, and 87.85% for BIR over a random sample of around 50% of runs.

“Agreement between LLM judge and human annotation, reported as percent agreement over a random sample of around 50% of runs.”

• Also stated in: § K Benchmark Construction & Reproducibility Statement · plain

  “| Metric Percent Agreement (%) | |”

• Also stated in: § K Benchmark Construction & Reproducibility Statement · plain

  “| ASR | 90.63 |”

May combine two claims.

Without rating signals, image-side modification of the 15-pack increased its selection from 10% to 76.67% and decreased the 12-pack from 70% to 20%.

“without rating signals, the targeted 15-pack rises from 10% of baseline selections to 76.67%, while the previously preferred 12-pack drops from 70% to 20%”

May combine two claims.

12 objective categories spanning user-, seller-, and platform-level harms are operationalized by 22 adversarial templates, comprising 9 DPI and 13 IPI templates.

“12 objective categories spanning user-, seller-, and platform-level harms are operationalized by 22 adversarial templates, comprising 9 DPI and 13 IPI templates”

May combine two claims.

With rating signals present, the image-side modification effect is partially attenuated but remains visible, with the targeted product rising to 23.33% despite its low rating.

“with rating signals present, the effect is partially attenuated but remains visible, with the targeted product rising to 23.33% despite its low rating”

May combine two claims.

Under DPI, ASR rises substantially (both agents above 80%).

“Under DPI, a reference-only condition, ASR rises substantially (both agents above 80%), confirming that direct input modification represents a stronger adversarial channel.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Each case is executed three times per agent-backbone pair, yielding 3,168 attacked runs in total.

“Each case is executed three times per agent-backbone pair, yielding 3,168 attacked runs in total.”

Classified as probably not a substantial claim.

StakeBench organizes prompt-injection attacks using an entity-centric taxonomy that classifies attacks by the stakeholder bearing the resulting harm rather than by application scenario or surface form.

“StakeBench organizes prompt-injection attacks using an entity-centric taxonomy that classifies attacks by the stakeholder bearing the resulting harm rather than by the application scenario or surface form through which the attack is delivered.”

Classified as probably not a substantial claim.

To isolate attack-induced failures from inherent agent limitations, we execute the corresponding benign user task in the unmodified environment without any adversarial environmental content, under identical execution configurations.

“To isolate attack-induced failures from inherent agent limitations, we execute the corresponding benign user task in the unmodified environment without any adversarial environmental content, under identical execution configurations.”

May combine two claims.

The online shopping domain naturally involves multiple stakeholders with potentially divergent interests, making it well-suited for entity-centric harm modeling.

“Second, the domain naturally involves multiple stakeholders with potentially divergent interests, making it well-suited for entity-centric harm modeling: the consequences of adversarial agent actions are not uniform across parties, enabling systematic attribution of harm to the stakeholders most directly affected.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The sandboxed environment preserves all structural properties required for meaningful evaluation, including a functional checkout and order-management pipeline, allowing success conditions to be defined in terms of executed actions and final environment state rather than model output alone.

“The sandboxed environment nonetheless preserves all structural properties required for meaningful evaluation, including a functional checkout and order-management pipeline, allowing success conditions to be defined in terms of executed actions and final environment state rather than model output alone.”

Probably not a substantial claim: may not pass S4 (based).

Each template instantiates plain prompt injection patterns already widely documented in the public literature.

“each instantiates plain promptinjection patterns that are already widely documented in the public literature and reproducible from generic descriptions of the technique”

Classified as probably not a substantial claim. May combine two claims.

StakeBench constructs benign tasks that reflect realistic user shopping intents and serve as the reference objective against which adversarial influence is measured.

“StakeBench constructs benign tasks that reflect realistic user shopping intents and serve as the reference objective against which adversarial influence is measured.”

Classified as probably not a substantial claim. May combine two claims.

Each benign task input prompt reflects a realistic shopping task delegation scenario, specifying the user's original goal, a plausible motivation for delegation, and the operational permissions required to complete the task.

“Each benign task input prompt reflects a realistic shopping task delegation scenario, specifying the user's original goal, situating the task within a plausible motivation for delegating execution to the agent, and granting the operational permissions required to complete the task.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Each of the 12 objectives captures a concrete and realistic adverse outcome plausible in real-world deployments, requires a meaningfully distinct pattern of agent behavior, and admits a clear and observable success condition evaluable end-to-end against the complete agent trajectory.

“Each of the 12 objectives captures a concrete and realistic adverse outcome plausible in real-world deployments, requires a meaningfully distinct pattern of agent behavior to realize, and admits a clear and observable success condition that can be evaluated end-to-end against the complete agent trajectory.”

May combine two claims.

The OneStopMarket environment supports dynamic page states, multi-step navigation, and a complete transactional pipeline including product search, review browsing, cart management, and checkout, making it suitable for system-level security evaluation of web agents.

“The environment supports dynamic page states, multi-step navigation, and a complete transactional pipeline including product search, review browsing, cart management, and checkout, making it suitable for system-level security evaluation of web agents that must perceive, reason, and act across extended interaction trajectories.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

To mitigate potential bias, annotators were not informed of the specific agent system or backbone model associated with each run, and run order was randomized across annotators.

“To mitigate potential bias, annotators were not informed of the specific agent system or backbone model associated with each run, and run order was randomized across annotators.”

May combine two claims.

ASR and TDR are weakly coupled in practice: low ASR does not imply preserved task integrity, and low TDR does not imply suppression of the adversarial objective.

“The dispersion across three distinct regimes shows that ASR and TDR are weakly coupled in practice: low ASR does not imply preserved task integrity, and low TDR does not imply suppression of the adversarial objective.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The two task categories (purchase-oriented and content-driven) cover the principal interaction patterns that arise when users delegate shopping tasks to web agents.

“Together these two categories cover the principal interaction patterns that arise when users delegate shopping tasks to web agents.”

Probably not a substantial claim: may not pass S4 (based).

The evaluation environment is fully sandboxed: all account information, shipping details, payment fields, order records, and reviews are benchmark artifacts that do not correspond to real users, addresses, payment instruments, or financial transactions.

“The environment is fully sandboxed: all account information, shipping details, payment fields, order records, and reviews used during evaluation are benchmark artifacts that do not correspond to real users, addresses, payment instruments, or financial transactions.”

May combine two claims.

Each instance receives three binary labels produced by an LLM-based judge operating on the executed trajectory and final environment state under template-specific success conditions, validated against human annotation.

“Each instance receives three binary labels, produced by an LLM-based judge operating on the executed trajectory and final environment state under template-specific success conditions and validated against human annotation (as illustrated in Appendix F.5)”

May combine two claims.

Semantic alignment modulates not only whether the adversarial objective is realized but also the qualitative shape of the failure when it is not.

“Semantic alignment therefore modulates not only whether the adversarial objective is realized but also the qualitative shape of the failure when it is not.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The human annotation study involves reviewing agent trajectories and assigning binary labels under predefined guidelines; annotators were not exposed to harmful or personally identifiable content, and participation was voluntary.

“The human annotation study involves reviewing agent trajectories and assigning binary labels under predefined guidelines; annotators were not exposed to harmful or personally identifiable content, and participation was voluntary.”

Classified as probably not a substantial claim. May combine two claims.

All experiments are conducted within a fully sandboxed e-commerce environment containing only benchmark artifacts; no real user data, financial transactions, or third-party systems are involved.

“All experiments are conducted within a fully sandboxed e-commerce environment containing only benchmark artifacts; no real user data, financial transactions, or third-party systems are involved at any stage.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This study qualifies for exemption from formal IRB review under standard institutional criteria, as it posed no more than minimal risk to participants.

“Accordingly, this study qualifies for exemption from formal IRB review under standard institutional criteria, as it posed no more than minimal risk to participants.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

No textual content, ratings, page structure, or metadata is altered in the visual manipulation.

“Crucially, no textual content, ratings, page structure, or metadata is altered.”

Classified as probably not a substantial claim.

Within each stakeholder category, StakeBench decomposes attacks into objective-level harms that correspond to distinct agent behaviors and measurable success conditions.

“Within each stakeholder category, StakeBench further decomposes attacks into objective-level harms that correspond to distinct agent behaviors and measurable success conditions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

No additional system prompt is injected beyond each agent's default configuration.

“No additional system prompt is injected beyond each agent's default configuration”

Classified as probably not a substantial claim.

Because agent actions can directly modify the shared environment, the consequences of a successful attack are ultimately borne by one or more of the User, Sellers, and Platform.

“Because agent actions can directly modify the shared environment, the consequences of a successful attack are ultimately borne by one or more of these parties.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The observed shifts in agent selection behaviour suggest that the IPI surface extends meaningfully beyond textual channels.

“The observed shifts in agent selection behaviour suggest that the IPI surface extends meaningfully beyond textual channels”

• AssumptionRests on an assumption: Diet Pepsi is a mundane, everyday consumer product that would not trigger heightened suspicion or deliberation in a typical user.
• AssumptionRests on an assumption: The realistic deployment context for adversarial visual manipulation is one in which the agent has no prior reason to be on guard.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The injected review in the E4 Order Tampering example is visually indistinguishable from legitimate user content, consistent with the realism criterion.

“The injected review is visually indistinguishable from legitimate user content, consistent with the realism criterion that governs template construction.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

All annotators were informed of the study purpose prior to participation, conducted their work in a standard office environment, and faced no physical or psychological health risks at any stage.

“All annotators were informed of the study purpose prior to participation, conducted their work in a standard office environment, and faced no physical or psychological health risks at any stage.”

Classified as probably not a substantial claim.

The visual manipulation is purely image-side, designed to inject false credibility signals through the visual channel alone.

“The manipulation is purely imageside, designed to inject false credibility signals through the visual channel alone”

Probably not a substantial claim: may not pass S3 (load-bearing).

TDR is not reported for DPI because DPI replaces or augments the user input itself, rendering benign-task deviation conceptually ill-defined.

“TDR is not reported for DPI because DPI replaces or augments the user input itself, rendering benign-task deviation conceptually ill-defined.”

Classified as probably not a substantial claim.

Each agent is evaluated using its default action interaction interface and observation pipeline without any modification to internal planning, browsing, memory, or tool-use mechanisms.

“Each agent is evaluated using its default action interaction interface and observation pipeline without any modification to internal planning, browsing, memory, or tool-use mechanisms”

Classified as probably not a substantial claim. May combine two claims.

The benign task elements establish the execution pipeline that the agent follows, and IPI embeds its adversarial payload within the environmental surfaces encountered along this pipeline.

“These elements establish the execution pipeline that the agent follows during task completion, and it is precisely within the environmental surfaces encountered along this pipeline that IPI embeds its adversarial payload.”

Probably not a substantial claim: may not pass S4 (based).

In the benchmark environment, the target product and its customer reviews are guaranteed to exist.

“The original product and its customer reviews are guaranteed to exist.”

• Also stated in: § General interpretation rules (selected): · plain

  “The target product and its customer reviews are guaranteed to exist.”

Classified as probably not a substantial claim.

Annotators were given the same instruction as the GPT-5 judge to ensure consistency between human and automated assessment.

“Annotators were given the same instruction was provided to the GPT-5 judge to ensure consistency between human and automated assessment.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Each benchmark instance is executed three times per agent-backbone pair.

“each benchmark instance is executed three times per agent-backbone pair”

Probably not a substantial claim: may not pass S4 (based).

The nature and severity of a prompt-injection attack are determined by who bears its consequences, not by the context in which it occurs.

“This design choice reflects a fundamental observation: the nature and severity of a prompt-injection attack are determined by who bears its consequences, not by the context in which it occurs.”

Classified as probably not a substantial claim.

A randomly sampled subset of 50% of the runs in the main experiment were independently reviewed by human annotators following the annotation guidelines in Table 11 to validate the reliability of the automated judge.

“To validate the reliability of the automated judge, a randomly sampled subset of 50% of the runs in the main experiment were independently reviewed by human annotators following the annotation guidelines in Table 11.”

May combine two claims.

The benchmark does not expose new attack surfaces, introduce novel exploitation capabilities, or provide adversaries with material advantage beyond what is already available.

“The benchmark therefore does not expose new attack surfaces, introduce novel exploitation capabilities, or provide adversaries with material advantage beyond what is already available”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

In the IPI setting, the attacker is restricted to content surfaces plausibly controllable in an e-commerce ecosystem (e.g., product reviews, rating signals, community-provided metadata) and cannot directly modify the user instruction, system prompt, agent implementation, browser state, platform backend, payment system, or authentication mechanism.

“In the IPI setting, the attacker may only control content surfaces that are plausibly controllable in an e-commerce ecosystem, such as product reviews, review-associated rating signals, and community-provided product metadata.”

• Also stated in: § B.3 Attacker Capabilities · hedged

  “The attacker may not directly modify the user instruction, system prompt, agent implementation, browser state, platform backend, payment system, or authentication mechanism.”

• AssumptionRests on an assumption: Content surfaces contributed by sellers (e.g., product reviews and metadata fields) are plausibly controllable channels through which an attacker may embed adversarial instructions.

Probably not a substantial claim: may not pass S3 (load-bearing).

The final template library reflects a substantially larger candidate pool that was reduced through pilot executions and iterative LLM-assisted rewriting to retain only templates satisfying realism, non-redundancy, and evaluability criteria.

“The final template library reflects a substantially larger candidate pool that was reduced through pilot executions and iterative LLM-assisted rewriting to retain only templates satisfying the realism, non-redundancy, and evaluability criteria established in Section 3.3.”

Probably not a substantial claim: may not pass S2 (checkable).

An entity-centric taxonomy makes evaluation results directly interpretable for practitioners with different threat priorities, allowing each stakeholder to consult relevant results rather than a single aggregate indicator.

“An entity-centric taxonomy instead makes evaluation results directly interpretable for practitioners with different threat priorities, since each stakeholder can consult the subset of results most relevant to the parties and harm objectives they care about, rather than reasoning from a single aggregate indicator that obscures the distribution of harm across parties.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The attacker cannot rewrite arbitrary webpage structure, create new interface elements, inject pop-up windows, access hidden agent state, intercept network traffic, exploit browser or operating-system vulnerabilities, or collude with the platform.

“The attacker cannot rewrite arbitrary webpage structure, create new interface elements, inject pop-up windows, access hidden agent state, intercept network traffic, exploit browser or operating-system vulnerabilities, or collude with the platform.”

• AssumptionRests on an assumption: The attacker limitations in StakeBench reflect the actual access available to a seller, reviewer, or metadata contributor on a real e-commerce platform.

Probably not a substantial claim: may not pass S4 (based).

The platform's trust mechanisms, authorization boundaries, and workflow integrity can be degraded by prompt-injection attacks, constituting harm to the platform even when no individual user or seller is directly targeted.

“As the provider of the operational infrastructure on which all parties depend, the platform is itself a stakeholder whose trust mechanisms, authorization boundaries, and workflow integrity can be degraded by promptinjection attacks, constituting harm to the platform even when no individual user or seller is directly targeted.”

Classified as probably not a substantial claim.

All four agent-backbone pairs are evaluated under identical execution configurations to ensure comparability.

“All four agent-backbone pairs are evaluated under identical execution configurations to ensure comparability.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

This activity qualifies for exemption from full IRB review under standard institutional criteria.

“This activity qualifies for exemption from full IRB review under standard institutional criteria.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Disagreements between annotators were resolved through discussion to produce a consensus label for each run.

“Third, disagreements between annotators were resolved through discussion to produce a consensus label for each run.”

May combine two claims.

Cross-system agent evaluation and multi-axis failure characterisation are only partially explored in existing benchmarks.

“In particular, while realism-oriented aspects such as environment fidelity and constraints of attackers' capabilities are well supported, cross-system agent evaluation and multi-axis failure characterisation are only partially explored [35].”

• cites [35]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Cases where annotators could not reach unanimous agreement were flagged for additional review, consistent with the need_human_review mechanism used in automated evaluation.

“Cases where annotators could not reach unanimous agreement were flagged for additional review, consistent with the need_human_review mechanism used in automated evaluation.”