Search papers, labs, and topics across Lattice.
This paper investigates the vulnerabilities of LLM-based web agents to phishing-style indirect prompt injection attacks, specifically focusing on login inducement through manipulated webpage content. The authors introduce LoginTrap, a novel attack that leverages webpage context to create page-specific indirect injections, successfully guiding agents to controlled login pages without needing knowledge of the user task or agent internals. Their comprehensive analysis reveals an alarming 86% average success rate for these attacks across various LLM architectures, highlighting a critical risk in the authentication processes of web agents.
LoginTrap exposes a staggering 86% success rate for phishing-style attacks on LLM-based web agents, revealing a gaping hole in authentication security.
LLM-based web agents automate user tasks by observing webpages and executing browser actions on behalf of users. As these agents operate on real web services, login becomes a sensitive authentication boundary because it involves credentials and sensitive information. Existing work shows that malicious webpage content can manipulate web agent actions, but it has not fully examined whether such content can induce login and cause end-to-end private data leakage. We study this attack surface and present LoginTrap, a task-agnostic login-inducing attack against LLM-based web agents. LoginTrap assumes a black box attacker that controls the webpage context and the induced login flow without knowing the user task or web agent internals. Under this threat model, LoginTrap uses webpage context to generate page-specific indirect injections through a fuzzing-inspired process, making login appear as a plausible prerequisite for continuing the task and guiding the agent to a controlled login page. We conduct a comprehensive analysis of LoginTrap across realistic web agent executions. The results show that LoginTrap reaches 86\% average end-to-end attack success across LLM backbones and remains effective across agent architectures and defenses. These findings identify login inducement as a systematic authentication boundary risk and motivate further research on authentication-aware defenses for web agents.
