Intact cuts prompt injection success in browser agents from 73.1% to 12.8%

Browser-based AI agents read other people's pages and act on the user's behalf, and a language model can easily be swayed by any sufficiently insistent text. The authors of a paper featured on Hugging Face Daily Papers propose Intact, a layer between the agent and the web that runs on an unmodified browser. On 1 091 pages with injected attacks, 12.8% of attacks get through the Intact planner, and each of them reaches at most a consent request to the user. A standard planner lets through 73.1%.

Where the agent's trust model breaks

Browsers have long operated under rules in which an element's capabilities depend on what it is and where it came from. A script from a third-party domain, a form field and an ad block get different permissions, regardless of what they say. The agent loses these distinctions. It sees a screenshot or flat text in which a comment under an article, a banner and a site's button all look the same. If an instruction is hidden in that text, the model may mistake it for the user's intent and use the user's authority on content that has no such authority.

The authors start from the assumption that LLMs will remain pliable. So the protection has to sit in the agent's interface to the web: it must guarantee the integrity of what the agent reads, interprets and does.

How Intact works

At its core is GenTree, a special page representation that stores the origin of every element along with its web semantics. The page reaches the model through GenTree one element at a time. The model makes its decision on each element without seeing the text of the others, so an injection in one place does not affect how another is interpreted. The agent harness executes a step only within the capabilities of the element it belongs to. Before acting on third-party content, it asks the user.

An important detail concerns attribution. The browser treats many elements as first-party when they are not. On 1 270 real pages, GenTree classifies 2.3 times more elements as third-party than the browser does, and the browser wrongly attributes 58.7% of those elements to the first party.

• Sample: 1 270 real pages, 1 091 of them with injected attacks
• Attribution: 2.3 times more third-party elements than the browser finds
• Browser error: 58.7% of third-party elements recorded as first-party
• Attacks getting through: 12.8% for Intact versus 73.1% for a standard planner
• Form of the breakthrough: with Intact, no further than a consent request
• Lost functionality: 3.7% of tasks
• Latency: the authors estimate that parallel scheduling can remove most of it

The cost of protection and what remains open

Isolating elements breaks tasks where meaning is assembled from several fragments of a page. Such cases make up 3.7%. Feeding elements in sequence adds latency, but the authors believe parallel scheduling will remove most of that overhead. For now, that is an estimate, not a measurement.

Questions remain. The figures come from the authors' own set of pages and attacks, and 12.8% is not zero. Moreover, a consent request merely shifts the decision to a human. If the agent asks too often, users will get used to clicking "allow." That is our own assumption and is not in the paper, but it is worth testing in real-world scenarios.

What teams building agents can take away

The idea carries over even without a ready-made Intact. Before handing a page to the model, it is worth preserving the origin of each fragment and not losing it when the DOM is flattened into text. Action permissions are better derived from an element's type and source than from what the model "understood" from the text. Any action based on third-party content should go through explicit confirmation. Finally, it makes sense to calculate in advance the share of tasks that isolation breaks. According to the paper, for the authors' set it is 3.7%.