Mind the Web: The Security of Web Use Agents

Web-use agents, autonomous AI systems that are capable of interacting with the web through browser emulation, are rapidly being deployed to automate complex tasks involving multi-tab navigation, DOM manipulation, and authenticated session access. These systems possess extensive browser privileges; however, this creates a critical and previously unexplored attack surface. This paper demonstrates how attackers can exploit web-use agents by embedding malicious content in web pages, such as comments, reviews, or advertisements, that agents encounter during legitimate browsing tasks. We introduce the task-aligned injection attack, which frames malicious content as helpful task guidance rather than obvious attacks, exploiting fundamental limitations in LLMs' contextual reasoning. Agents struggle to maintain contextual awareness and fail to detect when seemingly helpful web content contains steering attempts that deviate them from their original task goal. To scale this attack, we developed an automated three-stage pipeline that generates effective injections without the need for manual annotation or costly online agent interactions during training, maintaining efficiency even with limited training data. This pipeline produces a generator model that we evaluate on five popular agents (OpenAI Operator, Browser-Use, Do Browser, OpenOperator, and Perplexity Comet) using payloads organized by the Confidentiality-Integrity-Availability (CIA) security triad, including unauthorized camera activation, file exfiltration, user impersonation, phishing, and denial-of-service. Our generator was found to achieve over 80% attack success rate (ASR) with strong transferability across unseen payloads, diverse web environments, and different underlying LLMs. This attack was even successful against agents with built-in safety mechanisms, necessitating only that the attacker has the ability to post content on public websites. To address this risk, we propose multiple mitigation strategies such as oversight mechanisms, execution constraints, and task-aware reasoning techniques.