WIPI: A New Web Threat for LLM-Driven Web Agents
Date: 2024-02
Affected: ChatGPT plugins, Web GPTs, open-source web agents
Attack vector: prompt-injection
Category: research
Severity: High

Wu et al. introduce WIPI, where attacker-controlled webpages indirectly execute malicious instructions in web agents. Evaluated across seven ChatGPT plugin agents, eight Web GPTs, and three open-source web agents; over 90 percent ASR in black-box settings.


Mitigations:

Architectural layers (MAESTRO):