Browser-agent security simulator
Trace the hidden instruction.
Follow attacker-controlled text from an external artifact into agent context, then see which trust boundaries prevent it from becoming a memory write, message, or purchase.
External sourcePoisoned page
RetrieverContent enters context
PlannerInstruction competes
PolicyOrigin is checked
Tool sinkAction or block
Taint propagation map
Red marks data influenced by the injected instruction. Green marks a policy decision that stops propagation before a consequential sink.
trustedtaintedblocked
Step 0
Policy decision
Awaiting traceRun or step through the scenario to inspect where attacker influence enters, propagates, and reaches a protected operation.
No sink evaluated yet
Tainted stages0 / 7Influenced by external text
Blocked sinks0Prevented operations
Task utility100%Benign goal still possible
OutcomePendingNo action attempted
The model is not the security boundary.
Indirect prompt injection turns retrieved data into competing instructions. Robust systems preserve origin, minimize capabilities, and mediate tool calls outside the model instead of asking natural-language instructions to enforce themselves.
Keep data and authority in different lanes.
A retrieved document can inform the answer without gaining permission to redefine the task.
Untrusted evidencePrivileged intent
Reduce blast radius before inference.
Read-only tools cannot send mail, alter memory, or execute a purchase even if the planner is manipulated.
read_pagesearchsend_email
Propagate origin
Keep source labels attached as content is summarized, transformed, and passed between agent components.
Check task alignment
Ask whether a proposed action advances the user's stated objective, not whether its prose sounds plausible.
Gate irreversible sinks
Apply deterministic authorization and confirmation to writes, sends, purchases, and secret-bearing requests.
Test the whole agent, not one prompt.
Hold the user task constant. Plant the attack in external data. Record every tool result. Track provenance through transformations. Measure both attack success and benign task utility.
Primary sources behind the lab.
The simulator is an explanatory model, not a measured benchmark result. These papers and security guidance define the attack class, agent evaluation setting, instruction hierarchy, and practical risk controls.
INDIRECT PROMPT INJECTION
Not What You've Signed Up For
Greshake et al. formalize indirect prompt injection and demonstrate attacks through retrieved external content.
AGENT EVALUATIONAgentDojo
Debenedetti et al. introduce a dynamic environment for testing tool-using agents against attacks and defenses.
PRIVILEGE ORDERINGThe Instruction Hierarchy
Wallace et al. train models to prioritize privileged instructions over lower-trust conflicting text.
APPLICATION SECURITYOWASP LLM01:2025 Prompt Injection
OWASP describes direct and indirect injection risks, impacts, and layered mitigations for LLM applications.
Export the trust-boundary review.
Use the checklist before connecting a browser agent to consequential tools. Then see how Superpowers supports inspectable computer use and repeatable browser-agent workflows.
0 of 4 ready