WAAA: how agentic browsers resurrect classic web attacks
A May 2026 paper builds the first web-focused threat model for agentic browsers and shows that 10 long-mitigated web attacks come back — often amplified — because the agent is a confused deputy that cannot tell a task step from a web trap.
What is this?
In “WAAA! Web Adversaries Against Agentic Browsers” (arXiv 2605.05509, submitted 6 May 2026, cs.CR), Sohom Datta, Alex Nahapetyan, William Enck and Alexandros Kapravelos argue that the security research on agentic browsers has a blind spot. Almost all prior work studies one threat: indirect prompt injection. But an agentic browser is still a browser, driving real authenticated sessions, and so it inherits the entire history of traditional web attacks — cross-site request forgery, clickjacking, cross-origin data theft, UI redressing and the social-engineering tricks designed to fool humans. The paper builds the first web-focused threat model for these systems and uses it to derive a taxonomy of 20 attacks spanning the web and the LLM space, implementing 18 of them.
How it works
The authors extend the standard See → Act model of a browser agent to cover all components of a browser, then frame the agent as a confused deputy: a privileged actor that cannot reliably distinguish a legitimate task step from an attacker-planted instruction or interface element on the page. That single property is what reopens old wounds.
Modern browsers spent two decades building defenses — most importantly the same-origin policy (SOP) — to stop one site from reading or acting on another on the user’s behalf. An LLM agent operating across tabs and sessions can be steered by untrusted page content to perform exactly those forbidden cross-origin actions, effectively circumventing the boundaries the browser was built to enforce. The result, per the paper, is that 10 web threats reemerge, often in amplified form, once the agent can be influenced by content it reads. Classic CSRF needed a victim to be tricked into one forged request; an agent can be talked into chaining many such actions across origins as part of “completing the task.”
The paper does not treat this as a quirk of one model. A generalizability study runs 14 of the 20 attacks across 4 major LLM models from multiple vendors and finds they reproduce, which points to a paradigm-level weakness rather than a single buggy product. The findings are distilled into five major failure modes — the recurring ways agentic browsers break when facing traditional and LLM web threats — leading the authors to conclude that these systems need to be re-architected before they are ready for the current web.
Why it matters
The takeaway for builders is uncomfortable: hardening an agentic browser against prompt injection alone is necessary but nowhere near sufficient. The threat surface is the union of LLM attacks and the full back-catalog of web attacks, and the agent’s autonomy turns formerly user-gated exploits (the victim had to click) into automated ones (the agent clicks). Because the agent carries the user’s cookies and sessions, the blast radius is whatever those sessions can reach — email, banking, internal tools. Anyone shipping a browse-and-act agent on top of a frontier model is exposed regardless of which vendor they chose.
Defenses
The paper’s core prescription is architectural, not a single filter:
- Re-impose origin boundaries on the agent. Treat the agent as an untrusted cross-origin actor and re-apply same-origin-policy-style isolation to its actions, rather than letting it freely bridge tabs, sessions and origins.
- Separate task intent from page content. The confused-deputy problem is the root cause; defenses must give the agent a trustworthy channel for its actual task and refuse to take instructions or “buttons” rendered by untrusted pages as authority.
- Gate state-changing and cross-origin actions. Require explicit, scoped user confirmation for sensitive operations (form submission, payments, sharing, file access) — don’t let the agent auto-complete them because a page asked.
- Test the union, not just prompt injection. Red-team agentic browsers against the classic web attack catalog — CSRF, clickjacking, UI redressing, cross-origin reads — and across multiple base models, since the failures transfer.
Status
| Item | Detail |
|---|---|
| Disclosure | arXiv 2605.05509, submitted 6 May 2026 (cs.CR) |
| Authors | S. Datta, A. Nahapetyan, W. Enck, A. Kapravelos |
| Scope | First web-focused threat model for agentic browsers; 20-attack taxonomy, 18 implemented |
| Key finding | 10 long-mitigated web threats reemerge (often amplified); reproduces across 4 LLMs / multiple vendors; 5 failure modes |
| Mitigation | Re-architect agents around origin isolation and confused-deputy containment, not prompt-injection filtering alone |