AgentBreaker: Evaluating Context-Aware Indirect Prompt Injection Risks in Modern Web Agents

Recent advances in large language models (LLMs) have enabled autonomous web agents to perform complex user tasks by leveraging their adaptive decision-making capabilities. Despite their growing use in crawling the Web, their security implications under indirect prompt injection (IPI) attacks remain largely understudied. Prior studies have compiled static benchmarks or proposed dynamic frameworks that generate adversarial phrases aimed at deceiving a single LLM within a target agent. However, by ignoring the agent’s operating context, these approaches yield suboptimal IPI attacks against modern web agents leveraging multiple, specialized LLMs. In this paper, we study the vulnerability in web agents to malicious phrases embedded as HTML elements. To assess the security risks posed by this vulnerability, we present AgentBreaker, an IPI attack framework that autonomously composes adversarial phrases tailored to page-specific context. When processed by web agents, these DOM-embedded phrases induce adversarial behaviors, such as clicking attacker-designated HTML elements, posting attacker-provided text, and disclosing internal agent secrets. In our evaluation against five state-of-the-art web agents, AgentBreaker achieves an attack success rate of 71.7%–100% across 60 webpages sampled from Online-Mind2Web. We then propose practical defenses that not only mitigate observed threats but also address potential adaptive attacks. Our defenses reduce the attack success rate down to 1.7%. By conducting context-aware injection, AgentBreaker outperforms existing IPI frameworks, thereby accurately evaluating web agents’ susceptibility to IPI and providing stepping stones for countering this emerging threat.