A rendering browser has a well-understood security model built over twenty-five years: the same-origin policy, the sandbox, the permission prompts. An agentic browser breaks the assumption underneath all of it. The agent reads page content as instructions and can act on the user's authenticated sessions. Page content is attacker-controlled. That is the whole problem in one sentence.
We wanted a number rather than an argument. So we built a corpus, built a harness, and measured each defence we could think of — individually and stacked — against the same set of attacks.
The corpus
We assembled 1,400 injection attempts across nine vectors. Roughly 340 are adapted from published research and public disclosures; the remainder we wrote ourselves, including 160 contributed by three external security researchers who were asked specifically to break our defences rather than to demonstrate known techniques.
The ranking is instructive. Direct injection — text on a page the user is looking at, telling the agent to ignore its instructions — is the vector people think of first and among the least effective, because it has to survive the user glancing at the page. Indirect injection through retrieved content is far more dangerous: the agent pulls a passage out of the semantic index, and the user never sees the source at all.
Vectors we tested
- Direct page injection. Instructions in visible page text.
- Hidden-element injection. Instructions in elements hidden by CSS,
aria-hidden, or off-screen positioning. - Indirect retrieval injection. Instructions in a document that reaches the agent through the semantic index rather than the active tab.
- Metadata injection. Instructions in
alttext, title attributes, or structured data. - Multi-turn priming. Benign-looking content across several pages that only becomes an instruction in aggregate.
- Tool-result injection. Instructions returned by a tool the agent itself invoked.
- Encoding obfuscation. Instructions encoded to survive naive filtering.
- Authority spoofing. Content imitating system or developer messages.
- Chained exfiltration. Instructions that induce navigation to an attacker URL carrying data in the path.
No single defence is sufficient
We evaluated five configurations. Input filtering — scanning retrieved content for instruction-like patterns — is the approach most commonly proposed and performed worst, reducing success only from 61% to 38%. It fails because the space of ways to phrase an instruction is unbounded, and every filter we wrote was defeated within an afternoon by a researcher who could see it.
Provenance tagging, where every token entering the context is labelled with its origin and the model is trained to treat page-derived content as data rather than instruction, did substantially better at 22%. Capability gating — simply not granting the agent the ability to perform sensitive actions without an explicit grant — reached 18%, the best single-layer result, and it is the only defence that degrades gracefully, because it limits blast radius rather than trying to detect intent.
Every defence that works by detecting a malicious instruction can be defeated by rephrasing it. Every defence that works by limiting what the agent can do cannot. We now weight the second category far more heavily.
Layering works, but the residue is structural
Stacking provenance tagging, capability gating, and an explicit confirmation boundary brought aggregate success to 2.4%. That is a large improvement and it is not the same thing as being safe. The residual 34 successful attacks are not evenly distributed across vectors: 27 of them are chained exfiltration, and they share a structure.
In each case the attack does not ask the agent to do anything the user has not already authorised. It induces the agent to perform an authorised action — navigate to a URL, fill a search box — whose parameters carry the payload. The user approved “navigate”. They did not approve navigating to an address that encodes the contents of their previous tab in its path. A confirmation boundary that asks about the action but not its arguments will approve this every time.
| Vector | Undefended | Filtering | Provenance | Full stack |
|---|---|---|---|---|
| Direct page | 44% | 19% | 6% | 0.4% |
| Hidden element | 58% | 31% | 9% | 0.7% |
| Indirect retrieval | 79% | 62% | 34% | 2.1% |
| Metadata | 51% | 38% | 12% | 0.9% |
| Multi-turn priming | 66% | 58% | 41% | 3.6% |
| Tool result | 71% | 49% | 23% | 1.8% |
| Encoding obfuscation | 48% | 44% | 8% | 0.4% |
| Authority spoofing | 63% | 27% | 11% | 0.6% |
| Chained exfiltration | 74% | 68% | 52% | 11.3% |
What we changed
Three things went into the build as a result of this work. Parameters are now part of the confirmation boundary: when the agent proposes a navigation, the confirmation shows the full destination, and any URL whose path or query grew from page-derived content is flagged explicitly. Second, retrieved passages carry provenance through the entire pipeline rather than only at the retrieval boundary. Third, the agent's egress is restricted to origins already present in the user's session unless the user grants an exception, which converts most exfiltration attempts into a visible prompt.
We are not claiming this is solved. The honest summary is that we moved from a system that fails often and quietly to one that fails rarely and visibly, and that the remaining failures are concentrated in a category we understand but have not eliminated.
Method
Limitations
Our success criterion is strict in one direction and lenient in another: counting a vector as successful if any of five trials succeeded inflates rates relative to a per-trial measure, but it reflects what an attacker who can retry actually faces. The corpus is our own construction and certainly under-represents attacks we did not think of — the 160 externally contributed cases had a success rate roughly 1.6× our internal ones, which is a strong hint that adversarial imagination is the binding constraint on this kind of evaluation. Results are averaged across four models that differ substantially; per-model variance was large and we report it in the appendix rather than the headline.
The corpus is available to security researchers under a responsible-disclosure agreement. We pay for novel vectors that defeat the current stack. Write to security@dartbrowser.com.
Related work
Indirect prompt injection was named and demonstrated by Greshake et al. [1], and the direct form was catalogued earlier by Perez and Ribeiro [2] and in Willison's ongoing series [3]. AgentDojo [5] is the closest prior work to ours in intent, providing a dynamic environment for evaluating attacks and defences on tool-using agents. Where we differ is scope: AgentDojo evaluates agents against a suite of tasks and adversaries in a general setting, while we evaluate a single deployed browser agent against a corpus built specifically to defeat its own defences, including 160 vectors written by external researchers who could read our implementation. The resulting numbers are less generalisable and, we think, more actionable for the system they describe.
Artefacts
Everything below is published or available on request. A number nobody can reproduce is an advertisement, not a result.
References
- Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. AISec @ CCS.
- Perez, F., & Ribeiro, I. (2022). Ignore Previous Prompt: Attack Techniques For Language Models. NeurIPS ML Safety Workshop.
- Willison, S. (2022–). Prompt injection. simonwillison.net.
- Wallace, E., Feng, S., Kandpal, N., Gardner, M., & Singh, S. (2019). Universal Adversarial Triggers for Attacking and Analyzing NLP. EMNLP.
- Debenedetti, E., Zhang, J., Balunović, M., et al. (2024). AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. NeurIPS Datasets & Benchmarks.
- OWASP (2025). Top 10 for Large Language Model Applications.
Bhardwaj, M. (2026). Measuring prompt injection resistance in agentic browsers. Dart Browser Research, DBR-2026-03.
