EIA: Environmental Injection Attack on Generalist Web Agents
Date: 2024-09
Affected: SeeAct, WebArena, generalist web agents
Attack vector: prompt-injection
Category: research
Severity: High

Liao et al. introduce Environmental Injection Attack, embedding malicious DOM elements with persuasive instructions to leak PII from web agents. Reaches 70 percent ASR for PII theft and 16 percent for full user-request hijack. ICLR 2025.


Mitigations:

Architectural layers (MAESTRO):