Research map / Multi-agent systems and games / LLM agents
WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces WASP, a publicly available end-to-end benchmark for prompt injection attacks against web agents in self-hosted VisualWebArena GitLab and Reddit environments, finding high intermediate hijack rates but low full attacker-goal completion.
Problem
Existing prompt injection tests for web agents are unrealistic, over-powered, single-step, or not publicly released, so there is no standard end-to-end way to measure web agent security against injected instructions.
Approach
A black-box, realistic threat model where the attacker is only an adversarial user controlling specific webpage elements (posts/comments/issues), combined with multi-step attacker goals, plain-text and URL injection templates, and both rule-based end-to-end and LLM-judged intermediate attack success metrics on self-hosted sites.
Key results
- ASR-intermediate ranges from 17% to 86% across models and scaffoldings, with o1 (system role, tool calling) reaching 0.857.
- ASR-end-to-end stays low, reaching at most about 16.7% (o1 with tool calling), and 0% for several configurations.
- Defensive system prompting lowered ASR-intermediate for GPT-4o from 0.321 to 0.167 in the axtree setting, though utility also dropped.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add a defensive system prompt (ablation) | GPT-4o, VisualWebArena axtree · WASP task-related | ASR-intermediate: 0.321 -> 0.167 | Helped |
| Add a defensive system prompt (ablation) | GPT-4o, VisualWebArena axtree + SOM · WASP task-related | ASR-intermediate: 0.429 -> 0.226 | Helped |
| Add a defensive system prompt (ablation) | GPT-4o-mini, VisualWebArena axtree · WASP task-related | ASR-intermediate: 0.345 -> 0.333 | Helped |
| Add a defensive system prompt (ablation) | GPT-4o-mini, VisualWebArena axtree · WASP task-related | Utility: 0.432 -> 0.351 | Hurt |
| Use Tool Calling with instruction hierarchy instead of VisualWebArena axtree (ablation) | GPT-4o-mini · WASP task-related | ASR-intermediate: 0.345 -> 0.536 | Hurt |
| Place capability instructions in developer rather than system role (ablation) | OpenAI o1, Tool Calling · WASP task-related | ASR-intermediate: 0.857 -> 0.583 | Helped |
| Add a defensive system prompt (ablation) | Claude Sonnet 3.5 v2, CURI · WASP task-related | ASR-intermediate: 0.583 -> 0.512 | Helped |
| Add a defensive system prompt (ablation) | Claude Sonnet 3.7 Extended Thinking, CURI · WASP task-related | ASR-intermediate: 0.536 -> 0.500 | Helped |
| Use URL rather than plain-text injection (ablation) | GPT-4o, VisualWebArena axtree + SOM · WASP task-related injection comparison | ASR-intermediate: 0.238 -> 0.619 | Helped |
| Use URL rather than plain-text injection (ablation) | GPT-4o-mini, VisualWebArena axtree · WASP task-related injection comparison | ASR-intermediate: 0.286 -> 0.405 | Helped |
| Use URL rather than plain-text injection (ablation) | OpenAI o1, Tool Calling, system role · WASP task-related injection comparison | ASR-intermediate: 0.738 -> 0.976 | Helped |
| Use plain-text rather than URL injection (ablation) | Claude Sonnet 3.5 · WASP task-related injection comparison | ASR-end-to-end: 0.048 -> 0.071 | Helped |
Surprising findings
- Agents that are more hijacked can still fail to complete attacker goals, a phenomenon the authors term security through incompetence.
- Placing web content in the lowest-privilege instruction hierarchy messages still yielded some of the highest hijack rates (e.g., o1 system role at 0.857).
Limitations
- Only two environments (reddit and gitlab) are supported.
- Limited diversity of injection prompts (only two templates plus task-agnostic variants).
- Evaluated only on 84 tasks, with the intermediate judge relying on GPT-4o.
Experimental setup
Datasets: VisualWebArena reddit and gitlab environments
Benchmarks: WASP
Metrics: ASR-intermediate ASR-end-to-end Utility
Baselines: InjecAgent AgentDojo ASB Claude Computer Use
Builds on: VisualWebArena indirect prompt injection instruction hierarchy InjecAgent AgentDojo
Closest papers by meaning
- It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents (ICML 2026 · similarity 0.88)
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · similarity 0.87)
- Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition (NeurIPS 2025 · similarity 0.86)
- AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents (NeurIPS 2025 · similarity 0.86)
- CVE-Bench: A Benchmark for AI Agents’ Ability to Exploit Real-World Web Application Vulnerabilities (ICML 2025 · similarity 0.86)
- Optimizing Agent Planning for Security and Autonomy (ICLR 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.