In-Browser LLM-Guided Fuzzing for Real-Time Prompt Injection Testing in Agentic AI Browsers

2025-10-15

AI Summary

Large language model (LLM)-driven browser agents are vulnerable to indirect prompt injection attacks, wherein malicious instructions embedded in web content trigger cross-site privilege escalation, evading conventional security boundaries. Method: We propose the first fully client-side, real-time LLM-guided fuzzing framework for browsers. It integrates lightweight LLM inference, dynamic DOM analysis, sandboxed execution, and feedback-driven adaptive test generation—operating entirely within the browser without external dependencies. Results: Our framework autonomously explores attack surfaces and detects prompt injection vulnerabilities in mainstream AI browser extensions. Evaluation demonstrates high detection accuracy, low false-positive rates, and robust identification of diverse real-world prompt injection flaws. To our knowledge, this is the first end-to-end, closed-loop solution for assessing prompt injection robustness on the client side, enabling practical, deployable security evaluation for LLM-augmented web agents.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Prompt Engineering / Prompting
• Application Domains: Security

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

Large Language Model (LLM) based agents integrated into web browsers (often called agentic AI browsers) offer powerful automation of web tasks. However, they are vulnerable to indirect prompt injection attacks, where malicious instructions hidden in a webpage deceive the agent into unwanted actions. These attacks can bypass traditional web security boundaries, as the AI agent operates with the user privileges across sites. In this paper, we present a novel fuzzing framework that runs entirely in the browser and is guided by an LLM to automatically discover such prompt injection vulnerabilities in real time.

Problem

• Detecting indirect prompt injection attacks in AI browsers
• Automating vulnerability discovery using in-browser LLM-guided fuzzing
• Securing AI agents against malicious webpage instructions

Innovation

• In-browser fuzzing framework for real-time testing
• LLM-guided automatic discovery of vulnerabilities
• Targets prompt injection in agentic AI browsers