Untrusted Content Masking for Web Agents with Security Guarantees
Source: arXiv:2607.05277 · Published 2026-07-06 · By Kristina Nikolić, Egor Zverev, Javier Rando, Matthew Jagielski, Edoardo Debenedetti, Florian Tramèr
TL;DR
This paper addresses the challenge of securing web-based AI agents from prompt injection attacks that exploit the intermingling of trusted and untrusted content on web pages. Unlike text-based APIs where trusted instructions and untrusted data are naturally separated, a web agent observing the rendered DOM sees both simultaneously, breaking isolation guarantees needed to prevent injections. The authors propose Untrusted Content Masking (UCM), a defense that redacts untrusted DOM elements via labeled placeholders before the agent ever observes them. Interaction with masked elements is mediated through a quarantined model (Q-Model) that returns only type-constrained structured data, preventing malicious instructions from propagating.
UCM is evaluated on 10 domains of synthetic websites and the WebArena GitLab benchmark using state-of-the-art language agents. Results show that UCM preserves task utility comparable to undefended agents while incurring a modest 1.05–1.84× cost overhead. Importantly, UCM blocks all strengthened WASP prompt injection attacks (0% attack success) by construction. Automated inference of trust boundaries from sanitized DOM structure without manual annotation achieves high accuracy on real sites, enabling broader deployment. This work demonstrates a practical architecture that enforces a strict trusted/untrusted boundary even in structurally entangled web page environments, enabling secure and flexible AI agent interaction.
Key findings
- UCM defense achieves 0% attack success rate against strengthened WASP prompt injection attacks (Appendix E).
- On 10 custom website suites, UCM preserves task utility across trusted-content-only and untrusted-content-required tasks, matching undefended agent performance (Fig 2a).
- UCM introduces moderate cost overhead between 1.05× and 1.84× increase in API token billing, varying by agent model and task complexity (Fig 2b).
- Automated trust boundary identification via an LLM on sanitized DOM achieves high F1 scores: 0.879 on Booking, 0.997 on Reddit, and 0.840 on GitLab (Table 2).
- Allowing string outputs from the Q-Model with user approval recovers full utility for tasks requiring free-form untrusted content on GitLab (Fig 3).
- Q-Model uses type-constrained query outputs (bool, int, float, enum, date) to prevent control-flow hijacking through injected instructions.
- UCM’s separation mechanism maintains the agent's standard ReAct interaction loop without costly per-site typed API construction.
- Cost overhead decreases with stronger base models (Claude Sonnet 4.6 vs 4.5), indicating efficient scaling of UCM.
Threat model
The adversary controls all untrusted content regions on web pages visited by the agent, including arbitrary text and images, aiming to inject malicious instructions to hijack the agent's behavior. The adversary can exploit the language model's prompt context to influence outputs arbitrarily if it sees injected content. The site owner is assumed honest and correctly labels trusted versus untrusted DOM regions. The adversary cannot manipulate the trusted content or break out of the labeled boundaries. Active-content attacks and browser/OS compromises are out-of-scope.
Methodology — deep read
The authors start by defining a threat model where the adversary controls all untrusted page content but the site owner is honest and labels trusted versus untrusted DOM regions. The adversary can inject arbitrary text or images within untrusted regions aiming for prompt injections to manipulate the agent's output. The defense requires a trust anchor: either active site owners label untrusted page elements via CSS selectors, or passive owners rely on an LLM to infer the boundaries from sanitized DOM structure.
UCM operates by masking untrusted DOM elements with labeled placeholders before rendering them to the agent, removing the attack surface since the agent never directly processes adversarial text or images. For tasks that require accessing untrusted content, the agent queries a quarantined model (Q-Model), which receives the element ID, a natural language question, and a restricted return type (boolean, int, float, enum, date). The Q-Model returns structured answers constrained to that type, precluding free-form injection of malicious instructions.
They implement implementations using various agent architectures—Claude Sonnet 4.5, 4.6, GPT-5.4—with Claude Sonnet 4.5 serving as the Q-Model in all experiments. For evaluation, they construct 10 custom website environments across diverse domains each with explicit trusted/untrusted labels covering 10 agentic tasks per site split into two groups: those not requiring untrusted content and those that do.
Evaluation metrics include task utility (measured by automated UI interaction checks and correctness of model answers) and monetary cost computed from API token usage with May 2026 pricing. They compare undefended agents against agents defended with UCM masking plus Q-Model queries. A fallback allowing Q-Model string output after user approval is also tested to recover utility for some tasks.
On real websites, they test UCM on GitLab using ~41 WebArena task templates with hand-labeled trust boundaries injected via a proxy layer. Automated trust boundary detection is performed by prompting an LLM on sanitized DOM trees with structure preserved but textual content removed to prevent manipulation.
Attack analysis categorizes control-flow attacks (injecting malicious instructions) and data-flow attacks (corrupting returned data). Control-flow attacks are fully blocked by the masking and type constraints, as confirmed by empirical tests yielding 0% success. Data-flow attacks remain a limitation if the Q-Model returns incorrect but valid typed data; the authors propose mitigations like action-level security policies and user confirmation.
Overall, the methodology involves building a DOM-level masking pipeline, ensuring titght privilege separation, empirically measuring utility and security on realistic benchmarks, and validating automated boundary inference with an LLM.
Technical innovations
- Untrusted Content Masking (UCM) replaces untrusted DOM page elements with structured placeholders before exposure to agents, enforcing strict trusted/untrusted separation at the DOM level.
- A Quarantined Model (Q-Model) interface that accepts element IDs and type-constrained queries, ensuring agent access to untrusted content is mediated via structured, non-free-form outputs preventing instruction injection.
- Automated trust boundary inference using LLMs on content-sanitized DOM structures to generate CSS selectors identifying untrusted webpage regions without exposure to adversarial content.
- Integration of the masking defense with standard ReAct agent interaction loops, avoiding the need for costly per-site typed API development while providing formal security guarantees.
Datasets
- Custom Web Suites — 10 sites across banking, email, e-commerce, forum, and more — hand-labeled untrusted/trusted elements
- WebArena GitLab Suite — 41 task templates on GitLab website — public benchmark from Zhou et al. 2024
Baselines vs proposed
- Undefended Agent utility (task completion rate) = ~90%-100% vs UCM Masking Defense utility = ~90%-100% (no significant drop, Fig 2a)
- Cost per task (USD) Undefended = $0.03–$0.10 vs UCM Masking Defense = $0.05–$0.18 (up to 1.84x cost overhead, Fig 2b)
- Undefended on WebArena GitLab utility = ~95% vs UCM Masking Defense utility ~90% (improved to almost 100% with Q-Model string output allowance, Fig 3a)
- Attack success rate on WASP strengthened attacks Undefended: high (not quantified) vs UCM Masking Defense: 0% ASR (Appendix E)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.05277.
Fig 1: Overview of Untrusted Content Masking (UCM) defense. Untrusted webpage content
Fig 2 (page 2).
Fig 3 (page 2).
Fig 4 (page 2).
Fig 4: Comparison of webpage rendering with and without our UCM defense. (a) The standard
Fig 6 (page 15).
Fig 9: Automated boundary identification on Booking.com. Red regions are masked using CSS
Limitations
- UCM requires active honest site owners to provide accurate trust boundary labels for strict security guarantees; automated inference is promising but less precise.
- Does not address active-content attacks like XSS that can escape labeled boundaries or rewrite the DOM at runtime; relies on site security for these.
- Data-flow attacks via targeted manipulation of Q-Model outputs remain possible, potentially causing incorrect agent actions without control-flow violation.
- Fallback permitting Q-Model string outputs with user approval can reintroduce risk if users approve malicious content, depending on user vigilance.
- Evaluation focused on a moderate number of sites and tasks; broader deployment to diverse complex real-world sites with dynamic content remains to be validated.
- Assumes site owners are trustworthy and adversaries do not control entire pages; malicious sites are out-of-scope.
Open questions / follow-ons
- Can the LLM-based automated trust boundary inference be further improved in precision and recall across more diverse, dynamically generated web content?
- How can data-flow attacks be robustly mitigated by integrating user confirmation workflows or finer-grained action-level security policies without harming usability?
- What are the trade-offs when allowing limited free-form Q-Model outputs with user approval in terms of security, and can this approval process be automated or assisted?
- How does UCM scale and perform on highly dynamic or script-heavy web applications where the DOM changes frequently or untrusted content loads asynchronously?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners designing AI-powered web agents or browser automation tools, this work provides a rigorous architectural framework to prevent prompt injection attacks that exploit the co-location of trusted and untrusted content on web pages. Instead of heuristic content filtering or treating the entire page as trusted or untrusted, UCM provides a principled way to enforce strict privilege separation at the DOM level via masking, which reduces the attack surface to zero for control-flow hijacking vectors. The quarantined model component ensures safe, type-constrained information retrieval from untrusted elements, preserving agent utility while blocking malicious instruction injections.
These insights inform CAPTCHA design and bot-detection strategies by recognizing the importance of structural trust boundaries and strict interaction controls with untrusted content. Automated inference of these boundaries from sanitized DOMs suggests new tooling approaches to integrate security guardrails even when site owners do not explicitly label content. However, practitioners should be aware of remaining data-flow attack vectors and the reliance on site owners’ honesty and page instrumentation, which influence real-world deployment feasibility and threat mitigation effectiveness.
Cite
@article{arxiv2607_05277,
title={ Untrusted Content Masking for Web Agents with Security Guarantees },
author={ Kristina Nikolić and Egor Zverev and Javier Rando and Matthew Jagielski and Edoardo Debenedetti and Florian Tramèr },
journal={arXiv preprint arXiv:2607.05277},
year={ 2026 },
url={https://arxiv.org/abs/2607.05277}
}