Untrusted Content Masking for Web Agents with Security Guarantees
This work provides a principled defense for web agents against prompt injection, a critical security problem for LLM-based agents operating in untrusted environments.
The paper addresses the challenge of providing security guarantees against prompt injection attacks in web agents, where trusted and untrusted content are structurally entangled. The proposed Untrusted Content Masking (UCM) approach restores the trust boundary by redacting untrusted regions in the DOM and routing interactions through a sandboxed interface, enabling secure web agent operation.
Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which intermingles trusted content with untrusted content. This structural entanglement removes the trust boundary on which security guarantees depend, undermining provable defenses for web agents. In this paper, we present Untrusted Content Masking (UCM), a simple and effective approach that restores this boundary in web environments. We leverage a key structural insight: a webpage's Document Object Model (DOM) encodes sufficient information to distinguish trusted from untrusted regions without reading their content. Our framework exploits this by redacting untrusted regions before they reach the agent and routing interaction through a sandboxed interface with strict privilege separation, thereby enabling agents to observe and interact with their environment while remaining isolated from adversarial content. The code is publicly available.