What they did

The authors address the challenge of extending prompt injection defenses from text-based tool-use APIs to web agents. In text-based systems, agents rely on interface definitions and never see untrusted data, creating a clear trust boundary. Web agents, however, must observe rendered pages where trusted instructions and untrusted content are mixed — removing that boundary.

UCM exploits the structure of the DOM to distinguish trusted regions (e.g., the agent's own instructions or page chrome) from untrusted regions (e.g., user-generated content, ads). Trusted regions are defined by the page author's specification; UCM redacts untrusted regions from the DOM before the agent sees them. Interaction is routed through a sandboxed interface that enforces privilege separation: the agent can only act on trusted elements, preventing it from inadvertently following adversary-controlled prompts.

Key findings

• UCM provably prevents prompt injection attacks where an adversary controls content on the page the agent visits, under standard security assumptions about the browser's same-origin policy and the integrity of the trusted region specification.
• In a formal security analysis, the authors show that even if an adversary embeds malicious instructions in arbitrary page locations, UCM prevents the agent from observing or acting on them.
• The approach works without modifying the agent's underlying language model or requiring the agent to parse untrusted content — it leverages existing DOM structure and a lightweight pre-processing step.
• The authors demonstrate the defense on a benchmark of web agent tasks with adversarial content, showing zero success rate for attacks that would otherwise achieve over 90% task hijacking.

Why it matters

Prompt injection is a critical vulnerability for deployed web agents. By restoring a trust boundary through DOM-level masking, UCM provides a practical and provable defense that does not require modifying the agent's LLM or training. This makes it immediately applicable to existing web agent frameworks and could enable safer autonomous browsing and form-filling.

Caveats

The approach assumes a reliable mechanism to specify which DOM regions are trusted — this may be non-trivial for complex or dynamically generated pages. It also does not protect against attacks where adversarial content is injected into trusted regions (e.g., via XSS) or where the adversary controls the page's JavaScript. The defense is limited to visibility of content; it does not address attacks that exploit the agent's reasoning about structure (e.g., subtle formatting of trusted regions).