It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866912793609895936 |
|---|---|
| author | Korgul, Karolina Yang, Yushi Drohomirecki, Arkadiusz Błaszczyk, Piotr Howard, Will Aichberger, Lukas Russell, Chris Torr, Philip H. S. Mahdi, Adam Bibi, Adel |
| author_facet | Korgul, Karolina Yang, Yushi Drohomirecki, Arkadiusz Błaszczyk, Piotr Howard, Will Aichberger, Lukas Russell, Chris Torr, Philip H. S. Mahdi, Adam Bibi, Adel |
| contents | Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), an evaluation for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25\% of tasks on average (13\% for GPT-5 to 43\% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2512_23128 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents Korgul, Karolina Yang, Yushi Drohomirecki, Arkadiusz Błaszczyk, Piotr Howard, Will Aichberger, Lukas Russell, Chris Torr, Philip H. S. Mahdi, Adam Bibi, Adel Human-Computer Interaction Artificial Intelligence Multiagent Systems Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), an evaluation for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25\% of tasks on average (13\% for GPT-5 to 43\% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion. |
| title | It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents |
| topic | Human-Computer Interaction Artificial Intelligence Multiagent Systems |
| url | https://arxiv.org/abs/2512.23128 |