Large language model (LLM) based web agents are increasingly deployed to automate complex online tasks by directly interacting with web sites and performing actions on users' behalf. While these agents offer powerful capabilities, their design exposes them to indirect prompt injection attacks embedded in untrusted web content, enabling adversaries to hijack agent behavior and violate user intent. Despite growing awareness of this threat, existing evaluations rely on fixed attack templates, manually selected injection surfaces, or narrowly scoped scenarios, limiting their ability to capture realistic, adaptive attacks encountered in practice.
We present MUZZLE, an automated agentic framework for evaluating the security of web agents against indirect prompt injection attacks. MUZZLE utilizes the agent's trajectories to automatically identify high-salience injection surfaces, and adaptively generate context-aware malicious instructions that target violations of confidentiality, integrity, and availability. Unlike prior approaches, MUZZLE adapts its attack strategy based on the agent's observed execution trajectory and iteratively refines attacks using feedback from failed executions.
We evaluate MUZZLE across diverse web applications, user tasks, and agent configurations, demonstrating its ability to automatically and adaptively assess the security of web agents with minimal human intervention. Our results show that MUZZLE effectively discovers 44 new attacks on 4 web applications with 10 adversarial objectives that violate confidentiality, availability, or privacy properties across different LLMs and agent scaffolds. MUZZLE also identifies novel attack strategies, including 3 cross-application prompt injection attacks and an agent-tailored phishing scenario.
Governing Execution Risk in Agentic AI Systems: A Trajectory-Guided Framework for Red Teaming
Department of Information Systems, Business Statistics and Operations Management (ISOM), Hong Kong University of Science and Technology（香港科技大学信息系统、商务统计与运营管理系（ISOM））
Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection
School of Computing University of Georgia Athens, USA（佐治亚大学计算机学院 美国亚特兰大）；Department of Information Technology Kennesaw State University Kennesaw, USA（凯斯韦尔州立大学信息科技学院 美国凯斯韦尔）
RedEdit: Agentic Red-Teaming of Image Safety Classifiers via MCTS-Guided Photo-Editing
The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Weixin AI, Tencent Inc.（腾讯微信AI）；School of Science, Sun Yat-sen University（中山大学理学院）
DREAM: Dynamic Red-teaming across Environments for AI Models
Nanjing University of Science and Technology（南京理工大学）；The University of Hong Kong（香港大学）；Agency for Science, Technology and Research（科学技术研究局）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））
Agentic Security: A Systematization of Tools, Failure Modes, and Design Laws for LLM-Driven Penetration Testing
Ahsanullah University of Science and Technology（阿赫桑乌拉科技大学）；BRAC University（BRAC大学）；North South University（北南大学）；Missouri State University（密苏里州立大学）；Multimedia University（多媒体大学）；American International University-Bangladesh（孟加拉国美国国际大学）
Securing Multi-Agent GIS Systems: Risk Evaluation and Prompt Hardening Optimization
Department of Systems Design Engineering, University of Waterloo（系统设计工程系，滑铁卢大学）；Department of Mechatronics Engineering, University of Waterloo（机电工程系，滑铁卢大学）；Department of Geomatics Engineering, University of Calgary（测绘工程系，卡尔加里大学）；Department of Geography and Environmental Management, University of Waterloo（地理与环境管理系，滑铁卢大学）
