[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-web-ai-agents-fall-for-prompt-injection-25-of-the-time":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},3635,"web-ai-agents-fall-for-prompt-injection-25-of-the-time","Web AI Agents Fall for Prompt Injection 25% of the Time","A new benchmark finds that hidden instructions in web interfaces can hijack autonomous AI agents, with success rates varying widely across frontier models.","Researchers have a new way to measure how easily AI web agents get tricked into doing the wrong thing.\n\nThe Task-Redirecting Agent Persuasion Benchmark, or TRAP, tests how vulnerable large language model-powered web agents are to prompt injection — adversarial instructions buried in interface elements like buttons, text fields, or page content. Across six frontier models, agents were successfully redirected from their intended tasks 25% of the time on average. The range was stark: GPT-5 was fooled 13% of the time, while DeepSeek-R1 was hijacked in 43% of cases. Small tweaks to interface framing or surrounding context often doubled attack success rates.\n\nThe findings matter because web agents are no longer hypothetical. Companies are deploying them for email management, scheduling, and professional networking — tasks that involve real accounts, real contacts, and real consequences. An agent that can be nudged off-task by a malicious web page is not just an academic problem; it is a live attack surface. The benchmark also identifies psychologically driven patterns in how agents fail, suggesting the vulnerabilities are systemic rather than incidental.\n\nTRAP ships with a modular social-engineering injection framework and experiments on high-fidelity website clones, which means other researchers can extend it. Given that one in four tasks is already compromised under average conditions, the industry's habit of shipping agentic features first and auditing them later looks increasingly hard to defend.","[\"ai\",\"security\",\"llm\",\"web-agents\"]","2026-07-03T04:00:00.000Z","2026-07-03T10:38:56.530Z","2026-07-03T10:38:59.340Z","published",null,[],"ai",[24,26,27,28],"security","llm","web-agents",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2512.23128",0,{"sections":35},[36,40,44,49,54,59,64,69,74,79,84,88,93,98],{"name":37,"slug":24,"count":38,"latest_published_at":39},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":41,"slug":26,"count":42,"latest_published_at":43},"Security",294,"2026-07-15T19:59:48.000Z",{"name":45,"slug":46,"count":47,"latest_published_at":48},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Dev Tools","dev-tools",59,"2026-07-07T04:00:00.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":85,"slug":86,"count":82,"latest_published_at":87},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]