LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents

2026-08-05

AI Summary

This work addresses a critical yet underexplored vulnerability in LLM-driven web agents: their susceptibility to malicious websites that induce unintended logins, leading to end-to-end privacy breaches. The authors propose LoginTrap, a task-agnostic, phishing-style indirect prompt injection attack that dynamically crafts deceptive webpage content without requiring knowledge of the agent’s internal mechanisms. Leveraging a fuzzing-inspired context generation strategy, LoginTrap tricks the agent into misinterpreting login as an essential step for task completion, thereby redirecting it to attacker-controlled pages. This study is the first to identify login induction as a systemic authentication boundary risk, demonstrating an average end-to-end attack success rate of 86% across diverse LLM backends and agent architectures, thereby establishing the attack’s robust effectiveness against varied models and defense mechanisms.

Abstract

LLM-based web agents automate user tasks by observing webpages and executing browser actions on behalf of users. As these agents operate on real web services, login becomes a sensitive authentication boundary because it involves credentials and sensitive information. Existing work shows that malicious webpage content can manipulate web agent actions, but it has not fully examined whether such content can induce login and cause end-to-end private data leakage. We study this attack surface and present LoginTrap, a task-agnostic login-inducing attack against LLM-based web agents. LoginTrap assumes a black box attacker that controls the webpage context and the induced login flow without knowing the user task or web agent internals. Under this threat model, LoginTrap uses webpage context to generate page-specific indirect injections through a fuzzing-inspired process, making login appear as a plausible prerequisite for continuing the task and guiding the agent to a controlled login page. We conduct a comprehensive analysis of LoginTrap across realistic web agent executions. The results show that LoginTrap reaches 86\% average end-to-end attack success across LLM backbones and remains effective across agent architectures and defenses. These findings identify login inducement as a systematic authentication boundary risk and motivate further research on authentication-aware defenses for web agents.

Problem

• phishing-style attack
• indirect prompt injection
• LLM-based web agents
• login inducement
• authentication boundary

Innovation

• indirect prompt injection
• LLM-based web agents
• login-inducing attack
• task-agnostic phishing
• authentication boundary