🤖 AI Summary
This work identifies a novel website impersonation attack targeting LLM-driven autonomous web browsing agents. Adversaries accurately identify AI agent traffic via browser fingerprinting, automation framework signatures, and network behavioral patterns. Method: They dynamically serve visually benign yet maliciously poisoned web pages—embedding indirect prompt injection and other stealthy instructions—that exclusively affect AI agents while appearing normal to humans. The authors introduce the “parallel poisoning web attack” model, defining a covert threat surface specific to AI agents, and design a coordinated attack framework integrating multi-dimensional traffic fingerprinting with dynamic HTML content poisoning. Results: Experiments demonstrate that mainstream AI agents are vulnerable in realistic settings to data exfiltration, arbitrary code execution (e.g., malware deployment), and disinformation propagation, exposing fundamental weaknesses in current defense mechanisms against agent-specific threats.
📝 Abstract
This paper introduces a novel attack vector that leverages website cloaking techniques to compromise autonomous web-browsing agents powered by Large Language Models (LLMs). As these agents become more prevalent, their unique and often homogenous digital fingerprints - comprising browser attributes, automation framework signatures, and network characteristics - create a new, distinguishable class of web traffic. The attack exploits this fingerprintability. A malicious website can identify an incoming request as originating from an AI agent and dynamically serve a different, "cloaked" version of its content. While human users see a benign webpage, the agent is presented with a visually identical page embedded with hidden, malicious instructions, such as indirect prompt injections. This mechanism allows adversaries to hijack agent behavior, leading to data exfiltration, malware execution, or misinformation propagation, all while remaining completely invisible to human users and conventional security crawlers. This work formalizes the threat model, details the mechanics of agent fingerprinting and cloaking, and discusses the profound security implications for the future of agentic AI, highlighting the urgent need for robust defenses against this stealthy and scalable attack.