A research team built a framework that automatically finds and exploits security holes in AI web agents by watching how those agents actually behave.
LLM-based web agents, software that browses sites and acts on a user's behalf, face a class of attack called indirect prompt injection, where malicious text embedded in a webpage hijacks what the agent does next. Most prior security work used fixed scripts against manually chosen targets. MUZZLE works differently: it watches a live agent session, identifies which page elements the agent actually focuses on, then generates targeted malicious instructions in real time, refining them based on what failed. Across four web applications with ten adversarial objectives, it surfaced 44 new attacks, including three that hop between applications and a phishing scenario specifically designed to fool an AI agent rather than a human.
Every major AI lab is now shipping or building agents that browse untrusted web content on users' behalf, and none can fully control what a visited site contains. MUZZLE shows that static defenses collapse against an adaptive attacker, and that the blast radius is wider than a single app, with cross-application attacks capable of chaining a compromised session across services the user never intended to expose.
The same adaptive logic that makes MUZZLE a useful red-teaming tool is also a fairly accurate blueprint for what a motivated attacker would build next.