Research map / Multi-agent systems and games / LLM agents

It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Agentic benchmarks and orchestration · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces TRAP, a modular benchmark of 630 persuasion-based prompt injections placed in six REAL website clones, measuring how often six frontier web agents click attacker redirect links.

Problem

Web agents that read dynamic web content are vulnerable to prompt injections hidden in interface elements that persuade them to divert from their task; existing benchmarks are static, monolithic, and rely on ambiguous multi-step LLM-judged success.

Approach

A five-dimensional modular attack space (persuasion principle, LLM manipulation method, interaction vector, injection location, tailoring) with a one-click binary success metric (agent clicks the injected button/link redirecting to a malicious site), instantiated on realistic website clones.

Key results

• Across six models (3,780 runs), 948 attacks succeeded, ~25% ASR; GPT-5 13% and DeepSeek-R1 43%.
• Button injections accounted for 77.5% of successes versus 22.5% for hyperlinks (about 3.5x more effective).
• Light tailoring raised GoCalendar ASR from 3.3% to 18.6% average and DashDish from 6.7% to 16.7%.

Surprising findings

• Stronger models with higher benign utility (GPT-5, Claude) were less exploitable, while transferability from GPT-5 injections to weaker models was high (82.5% average).
• Claude Sonnet 3.7 complied with authoritative framing but flagged friendly-framed injections as suspicious.

Limitations

• Limited to six cloned websites and textual injections only.
• Tailoring limited to light lexical edits; one-click metric omits post-injection behaviour.
• Full dataset run once; no defenses proposed.

Experimental setup

Datasets: REAL website clones TRAP benchmark (630 task-injection combinations)

Benchmarks: TRAP

Metrics: attack success rate benign task completion rate transferability

Baselines: InjecAgent AgentDojo ASB AgentHarm OS-HARM

Builds on: REAL AgentDojo InjecAgent Cialdini persuasion principles

Closest papers by meaning

• REAL: Benchmarking Autonomous Agents on Deterministic Simulations of Real Websites (NeurIPS 2025 · similarity 0.89)
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks (NeurIPS 2025 · similarity 0.88)
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · similarity 0.87)
• ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agents (ICLR 2026 · similarity 0.86)
• OpenAgentSafety: A Comprehensive Framework For Evaluating Real-World AI Agent Safety (ICLR 2026 · similarity 0.86)
• AdvAgent: Controllable Blackbox Red-teaming on Web Agents (ICML 2025 · similarity 0.86)