Prismata: Confining Cross-Site Prompt Injection in Web Agents

Source: arXiv:2607.08147 · Published 2026-07-09 · By Corban Villa, Alp Eren Ozdarendeli, Sijun Tan, Raluca Ada Popa

TL;DR

This paper addresses the emerging vulnerability known as Cross-Site Prompting (XSP) in autonomous web agents, where natural language instructions embedded in third-party or user-generated content hijack browser-based agents via prompt injections. Unlike classical XSS attacks that exploit executable script injection, XSP leverages natural language prompts and site content manipulations that existing sanitization or sandboxing approaches cannot detect or prevent. The key challenge is that determining a secure, task-specific policy requires understanding the web page's structure, which itself is entangled with potentially attacker-controlled content.

The authors propose Prismata, a novel system enforcing a contextual least-privilege model for web agents that limits both the content visible to an agent and its permitted actions, dynamically derived from the page’s DOM structure without requiring developer annotations. Prismata’s two core mechanisms are dynamic trust derivation which labels page elements by content origin and permissions using structural cues and integrity constraints inspired by the Biba model, and mechanical confinement which enforces these permissions via content redaction and action gating. An empirical study of 1,500+ popular sites shows Prismata covers virtually all actionable elements safely by either excluding attacker content from agent views or anticipating untrusted content boundaries. Evaluations on published and adaptive web agent attacks reduce attack success from 85.5% to 0.7% while preserving task utility, demonstrating practical viability.

Key findings

• Only 1.2% of over 90,000 untrusted content instances lie on critical paths to actionable elements across 1,500+ popular sites.
• Structural cues such as headings and accessibility attributes precede untrusted content for 91.3% of these critical path cases, enabling detection before exposure.
• The residual risk, where attacker content lies on a critical path with no preceding cue, is only 0.1% across all paths and reduces to 0.017% on sites following web best practices.
• Prismata reduces web agent attack success rates from 85.5% to 0.7% on average across multiple adaptive prompt-injection attack templates.
• Task completion rates under attack improve from 4.5% without defense to 23.0% with Prismata enabled.
• Benign task utility is largely preserved: success changes marginally from 29.9% to 26.6% when deploying Prismata without attacks.
• Trust label assignments cache effectively across pages of the same site, enabling runtime overhead reduction via DOM lineage reuse.
• Prismata’s policy enforcement blocks all agent actions exceeding dynamically derived permissions, preventing privilege escalation or unintended interactions.

Threat model

The adversary is a malicious user or external party able to inject natural language prompt-injection content into user-generated, hosted-party, or external embedded content areas of a benign website. They cannot execute arbitrary JavaScript on the trusted origin (classical XSS), as this is prevented by sandboxing and content security policies. The attacker may observe or infer the web agent’s task and adaptively craft injection payloads, but cannot bypass the agent’s closed finite action space or Prismata’s enforcement checks. The defender targets attacks that exceed the legitimate least-privilege scope of the user-assigned task.

Methodology — deep read

1. Threat Model & Assumptions: Prismata focuses on attackers injecting natural-language prompt-injections via untrusted user-generated, hosted-party, or external content on benign websites that implement standard XSS mitigations like sandboxed iframes and content security policies. The attacker can craft adaptive prompt injections and infer the agent’s task, but cannot execute arbitrary JavaScript on the trusted origin. Attacks are assumed limited to known web content injection vectors without active code execution exploits.

2. Data: They built a large corpus of 5,664 DOM snapshots sampled evenly from Common Crawl (2,832 top 10K domains, 100 pages each) and Mind2Web task traces, covering static and interactive pages. Over 90,000 untrusted content path instances were identified. Ground truth labeling for content provenance used a custom language model with hand-tuned prompts; structural cue detection used a second model to find DOM regions signaling boundaries of untrusted content.

3. Algorithm & Architecture: Prismata’s defense has three stages:

• Action Gate: For each DOM interactive element (buttons, links, inputs), the system traces its critical path from the DOM root to the element. An LLM evaluates the user task and element path text in isolation (without other page content) to derive a scope permission (capgate) marking in-scope or out-of-scope.
• Biba Parsing: This step classifies DOM elements by origin (developer, user, hosted-party, external) using only element and ancestry data, masking siblings and descendants (no-read-down). Structural cues (headings, aria-labels, class names) preceding untrusted content define trust boundaries. Trust labels and capability assignments per element are locked progressively down the path (no-write-up). This enforces least privilege by pruning out-of-scope or muting dangerous elements.
• Enforcement: Using the origin-based policy determined solely from the task parameters (not DOM), the enforcement layer mechanically prunes prohibited content from observations and disables disallowed interactions. Prismata filters the accessibility tree view of content sent to the agent, mapping labeled DOM elements to capability restrictions. Actions requested by the agent are checked against authorized capabilities before execution.

4. Training or runtime details: The main learning components are the provenance and structural cue LLM classifiers, iteratively prompt-tuned with manual checks. The critical path action gate decision uses an LLM to evaluate element context plus task description independently per element. Labeling is re-computed for each page state but benefits greatly from caching due to repeated DOM structure between pages.

5. Evaluation Protocol: Prismata is evaluated via the WebArena environment with Chromium-driven agents restricted to finite action sets. The authors inject three prompt-injection attack templates (Shortcut, Fake Completion, Ignore Instruction) targeting common web agent vulnerabilities. Metrics include attack success rate (agent performing attacker’s goal), benign task success rate, and labeling correctness checked against human judgments. They quantitatively analyze the DOM corpus for injection path statistics, structural cue coverage, and trust label stability. Runtime overhead and caching effectiveness are measured.

6. Reproducibility: The evaluation framework is modular and extensible, allowing new attacks and defenses to be integrated. While exact code release status is not stated, the use of BrowserGym and Playwright provides a replicable platform. Some components rely on proprietary or manually tuned LLM prompts, affecting full reproducibility.

Technical innovations

• Dynamic trust derivation that produces least-privilege permission labels per element by reasoning only over critical DOM paths independent of attacker content outside those paths.
• Biba-inspired recursive no-read-down, no-write-up parsing of the DOM path with structural cues to identify untrusted boundaries and confine malicious content before exposure.
• Mechanical confinement layer that deterministically enforces labels by redacting, downgrading, or disabling interactive elements in the agent’s filtered accessibility-tree observation.
• Injection-free labeling definition and formal analysis demonstrating that combined action gate and Biba parsing restrict influence of attacker content to rare, empirically negligible cases.

Datasets

• Common Crawl top 10K domain snapshots — ~283,200 DOMs sampled across 2,832 domains
• Mind2Web interactive browsing task traces — equivalent 2,832 DOMs

Baselines vs proposed

• No defense baseline: attack success rate = 85.5% vs Prismata: 0.7%
• No defense baseline: task success under attack = 4.5% vs Prismata: 23.0%
• No defense baseline: benign task success = 29.9% vs Prismata: 26.6%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.08147.

Fig 2: Web Entanglement Problem: Tool-agent defenses

Fig 3: Prismata’s Interface: Prismata operates between the web agent and the browser, providing a system-level defense that

Fig 7: Attacks Overview: We evaluate Prismata under three pop-up attack templates adapted from Pop-up [93] attacks. These

Limitations

• Residual labeling risk exists for ~0.1% of DOM paths where attacker content lies on the critical path with no preceding structural cue (Case 3 configuration).
• Prismata operates in the text input modality only; extension to images or non-textual inputs is future work.
• Assumes sites follow web security best practices (e.g., proper use of links and state-changing actions) to reduce residual risk.
• Does not defend against prompt injections that remain within the legitimate privilege scope, such as fake reviews influencing preferences.
• Relies in part on heuristic LLM-based provenance and structural cue labeling models that may misclassify rare page structures.
• Focuses on benign websites with sandboxed iframes and content security policies; classical XSS with arbitrary code execution remains out of scope.

Open questions / follow-ons

• How can Prismata’s dynamic trust derivation be extended or adapted to support non-textual modalities such as images or video embedded in page content?
• Can the labeling models (provenance and structural cues) be improved or replaced with end-to-end learned representations to reduce residual labeling errors further?
• How does Prismata perform under sophisticated adversarial pressure targeting the labeling LLMs themselves, such as adversarial prompt injection attempts on critical paths?
• What are practical tradeoffs for scaling Prismata to extremely dynamic web applications with frequently changing DOMs and complex asynchronous content?

Why it matters for bot defense

Prismata provides a system-level defense framework that web agents can deploy to mitigate prompt injection attacks, a growing threat as autonomous browsing automation gains popularity. For bot-defense and CAPTCHA engineering, Prismata highlights the importance of fine-grained, contextual least privilege derived from page structure and data provenance rather than relying solely on sanitizers or model robustness. The notion of isolating attacker-controlled inputs along limited critical DOM paths and enforcing strict capability assignments could inform a next generation of CAPTCHA challenges designed to detect or confine automation attempting task escalation through language or interface manipulation.

Moreover, Prismata’s mechanical confinement approach of filtering the agent’s observation and restricting actions based on provenance and inferred task scope could be applied to safeguard CAPTCHA flows from auto-solvers hijacking trusted user interactions. The methodology of automatic trust derivation without developer annotations supports scalable deployment even on the heterogeneous long-tail of websites—an enduring challenge for web security defenses. Overall, Prismata is a valuable architectural pattern integrating classical security models with modern LLM reasoning to contain natural language-based prompt injection risks in web automation, a domain CAPTCHAs increasingly intersect with.

Cite

@article{arxiv2607_08147,
  title={ Prismata: Confining Cross-Site Prompt Injection in Web Agents },
  author={ Corban Villa and Alp Eren Ozdarendeli and Sijun Tan and Raluca Ada Popa },
  journal={arXiv preprint arXiv:2607.08147},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.08147}
}

Read the full paper

• arXiv:2607.08147 (abstract)
• arXiv:2607.08147 (PDF)