Untrusted Content Masking (UCM) defends web agents from by exploiting the DOM structure to distinguish trusted from untrusted content without reading it. Untrusted regions are redacted and replaced with placeholders before the agent sees the page; the agent queries a sandboxed quarantined model that reads the hidden content and returns only structured responses (e.g., boolean, integer). Evaluated on 10 custom websites and WebArena GitLab with three frontier agents, UCM preserved task utility with moderate cost and blocked all strengthened WASP attacks (0% attack success rate). This is interesting because it provides security guarantees while keeping agents functional in real web environments.
Masking untrusted web content to secure agents against prompt injection
By redacting untrusted regions of the DOM before they reach the agent, the authors restore a trust boundary that enables provable security guarantees for web-based agents.
Big Tech
Kristina Nikolić · Egor Zverev · Javier Rando · Matthew Jagielski · Edoardo Debenedetti · Florian Tramèr
ETH Zurich · ISTA · Anthropic
Research Digest··3 min read
Thread:Agent Rule Compliance
In one line
Web agents can be secured against prompt injection by masking untrusted content in the DOM and using a sandboxed interface.
Before you read this
An idea this paper builds onRead it as
The authors introduce Untrusted Content Masking (UCM), a defense that prevents prompt injection attacks on web agents by masking untrusted content in the Document Object Model (DOM) before the agent processes it.
The authors address the challenge of extending defenses from text-based tool-use APIs to web agents.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
What it released
Code